@morphllm/morphmcp 0.8.27 → 0.8.28

package/dist/index.js

@@ -10,7 +10,6 @@ import { z } from "zod";
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { createTwoFilesPatch } from 'diff';
 import { minimatch } from 'minimatch';
-import { isPathWithinAllowedDirectories } from './path-validation.js';
 import { getValidRootDirectories } from './roots-utils.js';
 import { executeEditFile } from '@morphllm/morphsdk/tools/fastapply';
 import { runWarpGrep, LocalRipgrepProvider } from '@morphllm/morphsdk/tools/warp-grep';
@@ -154,31 +153,10 @@ await Promise.all(args.map(async (dir) => {
 // Security utilities
 async function validatePath(requestedPath) {
     const expandedPath = expandHome(requestedPath);
-    // Enhanced workspace-aware path resolution
-    let absolute;
-    if (path.isAbsolute(expandedPath)) {
-        absolute = path.resolve(expandedPath);
-    }
-    else {
-        // Use workspace root if available and in workspace mode, otherwise use cwd
-        const contextDir = (ENABLE_WORKSPACE_MODE && allowedDirectories.length > 0)
-            ? allowedDirectories[0]
-            : process.cwd();
-        absolute = path.resolve(contextDir, expandedPath);
-    }
-    const normalizedRequested = normalizePath(absolute);
-    // Check if path is within allowed directories
-    const isAllowed = isPathWithinAllowedDirectories(normalizedRequested, allowedDirectories);
-    if (!isAllowed) {
-        throw new Error(`Access denied - path outside allowed directories: ${absolute} not in ${allowedDirectories.join(', ')}`);
-    }
+    const absolute = path.resolve(expandedPath);
     // Handle symlinks by checking their real path
     try {
         const realPath = await fs.realpath(absolute);
-        const normalizedReal = normalizePath(realPath);
-        if (!isPathWithinAllowedDirectories(normalizedReal, allowedDirectories)) {
-            throw new Error(`Access denied - symlink target outside allowed directories: ${realPath} not in ${allowedDirectories.join(', ')}`);
-        }
         return realPath;
     }
     catch (error) {
@@ -186,12 +164,8 @@ async function validatePath(requestedPath) {
         if (error.code === 'ENOENT') {
             const parentDir = path.dirname(absolute);
             try {
-                const realParentPath = await fs.realpath(parentDir);
-                const normalizedParent = normalizePath(realParentPath);
-                if (!isPathWithinAllowedDirectories(normalizedParent, allowedDirectories)) {
-                    throw new Error(`Access denied - parent directory outside allowed directories: ${realParentPath} not in ${allowedDirectories.join(', ')}`);
-                }
-                return absolute;
+                const realParent = await fs.realpath(parentDir);
+                return path.join(realParent, path.basename(absolute));
             }
             catch {
                 throw new Error(`Parent directory does not exist: ${parentDir}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morphllm/morphmcp",
-  "version": "0.8.27",
+  "version": "0.8.28",
   "description": "Fast & accurate MCP server with AI-powered file editing and intelligent code search. Prevents context pollution and saves time for a better user experience.",
   "license": "MIT",
   "author": "Morph (https://morphllm.com)",