@n24q02m/better-godot-mcp 1.2.1 → 1.2.3

package/README.md

@@ -3,7 +3,7 @@
 **Composite MCP Server for Godot Engine - Optimized for AI Agents**
 
 [![CI](https://github.com/n24q02m/better-godot-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/n24q02m/better-godot-mcp/actions/workflows/ci.yml)
-[![Codecov](https://img.shields.io/codecov/c/github/n24q02m/better-godot-mcp?logo=codecov&logoColor=white)](https://codecov.io/gh/n24q02m/better-godot-mcp)
+[![codecov](https://codecov.io/gh/n24q02m/better-godot-mcp/graph/badge.svg?token=PF94LT0K2L)](https://codecov.io/gh/n24q02m/better-godot-mcp)
 [![npm](https://img.shields.io/npm/v/@n24q02m/better-godot-mcp?logo=npm&logoColor=white)](https://www.npmjs.com/package/@n24q02m/better-godot-mcp)
 [![Docker](https://img.shields.io/docker/v/n24q02m/better-godot-mcp?label=docker&logo=docker&logoColor=white&sort=semver)](https://hub.docker.com/r/n24q02m/better-godot-mcp)
 [![License: MIT](https://img.shields.io/github/license/n24q02m/better-godot-mcp)](LICENSE)

package/bin/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// @n24q02m/better-godot-mcp v1.2.1
+// @n24q02m/better-godot-mcp v1.2.3
 // Auto-generated CLI bundle - do not edit directly
 
 
@@ -161,7 +161,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 
 // src/tools/composite/animation.ts
 import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 
 // src/tools/helpers/errors.ts
 var GodotMCPError = class extends Error {
@@ -198,9 +198,25 @@ function formatJSON(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
 }
 
+// src/tools/helpers/paths.ts
+import { isAbsolute, relative, resolve } from "node:path";
+function safeResolve(baseDir, targetPath) {
+  const resolvedBase = resolve(baseDir);
+  const resolvedTarget = resolve(resolvedBase, targetPath);
+  const relativePath = relative(resolvedBase, resolvedTarget);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    throw new GodotMCPError(
+      `Access denied: Path '${targetPath}' resolves to '${resolvedTarget}' which is outside the project root '${resolvedBase}'.`,
+      "INVALID_ARGS",
+      "Ensure all file paths are within the project directory."
+    );
+  }
+  return resolvedTarget;
+}
+
 // src/tools/composite/animation.ts
 function resolveScene(projectPath, scenePath) {
-  const fullPath = projectPath ? resolve(projectPath, scenePath) : resolve(scenePath);
+  const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve2(scenePath);
   if (!existsSync2(fullPath))
     throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check the file path.");
   return fullPath;
@@ -326,13 +342,13 @@ Track data format: tracks/N/keys = { "times": PackedFloat32Array(0, 1), "values"
 
 // src/tools/composite/audio.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 async function handleAudio(action, args, config) {
   const projectPath = args.project_path || config.projectPath;
   switch (action) {
     case "list_buses": {
       if (!projectPath) throw new GodotMCPError("No project path specified", "INVALID_ARGS", "Provide project_path.");
-      const busLayoutPath = resolve2(projectPath, "default_bus_layout.tres");
+      const busLayoutPath = resolve3(projectPath, "default_bus_layout.tres");
       if (!existsSync3(busLayoutPath)) {
         return formatJSON({ buses: [{ name: "Master", volume: 0, effects: [] }], note: "Using default bus layout." });
       }
@@ -350,7 +366,7 @@ async function handleAudio(action, args, config) {
       const busName = args.bus_name;
       if (!busName) throw new GodotMCPError("No bus_name specified", "INVALID_ARGS", "Provide bus name.");
       const sendTo = args.send_to || "Master";
-      const busLayoutPath = resolve2(projectPath, "default_bus_layout.tres");
+      const busLayoutPath = resolve3(projectPath, "default_bus_layout.tres");
       let content;
       if (existsSync3(busLayoutPath)) {
         content = readFileSync2(busLayoutPath, "utf-8");
@@ -394,7 +410,7 @@ ${newBus}
         );
       }
       const fullEffectType = effectType.startsWith("AudioEffect") ? effectType : `AudioEffect${effectType}`;
-      const busLayoutPath = resolve2(projectPath, "default_bus_layout.tres");
+      const busLayoutPath = resolve3(projectPath, "default_bus_layout.tres");
       let content;
       if (existsSync3(busLayoutPath)) {
         content = readFileSync2(busLayoutPath, "utf-8");
@@ -451,7 +467,7 @@ ${effectRef}`;
       const streamType = args.stream_type || "2D";
       const parent = args.parent || ".";
       const bus = args.bus || "Master";
-      const fullPath = projectPath ? resolve2(projectPath, scenePath) : resolve2(scenePath);
+      const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve3(scenePath);
       if (!existsSync3(fullPath))
         throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check file path.");
       let content = readFileSync2(fullPath, "utf-8");
@@ -500,6 +516,13 @@ async function handleConfig(action, args, config) {
       if (!validKeys.includes(key)) {
         throw new GodotMCPError(`Invalid config key: ${key}`, "INVALID_ARGS", `Valid keys: ${validKeys.join(", ")}`);
       }
+      if ((key === "project_path" || key === "godot_path") && /[;&|`$(){}]/.test(value)) {
+        throw new GodotMCPError(
+          `Invalid characters in ${key}`,
+          "INVALID_ARGS",
+          "Path must not contain shell metacharacters: ; & | ` $ ( ) { }"
+        );
+      }
       runtimeConfig[key] = value;
       if (key === "project_path") {
         config.projectPath = value;
@@ -518,8 +541,8 @@ async function handleConfig(action, args, config) {
 }
 
 // src/tools/composite/editor.ts
-import { exec } from "node:child_process";
-import { resolve as resolve3 } from "node:path";
+import { execFile } from "node:child_process";
+import { resolve as resolve4 } from "node:path";
 import { promisify } from "node:util";
 
 // src/godot/headless.ts
@@ -568,11 +591,11 @@ function launchGodotEditor(godotPath, projectPath) {
 }
 
 // src/tools/composite/editor.ts
-var execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
 async function getGodotProcessesAsync() {
   try {
     if (process.platform === "win32") {
-      const { stdout: stdout2 } = await execAsync('tasklist /FI "IMAGENAME eq godot*" /FO CSV /NH', {
+      const { stdout: stdout2 } = await execFileAsync("tasklist", ["/FI", "IMAGENAME eq godot*", "/FO", "CSV", "/NH"], {
         encoding: "utf-8"
       });
       return stdout2.split("\n").filter((line) => line.includes("godot")).map((line) => {
@@ -580,7 +603,7 @@ async function getGodotProcessesAsync() {
         return { pid: parts[1] || "unknown", name: parts[0] || "godot" };
       });
     }
-    const { stdout } = await execAsync("pgrep -la godot", {
+    const { stdout } = await execFileAsync("pgrep", ["-la", "godot"], {
       encoding: "utf-8"
     });
     return stdout.split("\n").filter(Boolean).map((line) => {
@@ -605,7 +628,7 @@ async function handleEditor(action, args, config) {
       if (!projectPath) {
         throw new GodotMCPError("No project path specified", "INVALID_ARGS", "Provide project_path argument.");
       }
-      const { pid } = launchGodotEditor(config.godotPath, resolve3(projectPath));
+      const { pid } = launchGodotEditor(config.godotPath, resolve4(projectPath));
       return formatSuccess(`Godot editor launched (PID: ${pid})`);
     }
     case "status": {
@@ -680,7 +703,7 @@ async function handleHelp(action, args) {
 
 // src/tools/composite/input-map.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join3, resolve as resolve4 } from "node:path";
+import { join as join3, resolve as resolve5 } from "node:path";
 var GODOT_KEY_CODES = {
   // Letters (ASCII)
   KEY_A: 65,
@@ -790,7 +813,7 @@ function resolveMouseCode(value) {
 }
 function getProjectGodotPath(projectPath) {
   if (!projectPath) throw new GodotMCPError("No project path specified", "INVALID_ARGS", "Provide project_path.");
-  const configPath = join3(resolve4(projectPath), "project.godot");
+  const configPath = join3(resolve5(projectPath), "project.godot");
   if (!existsSync5(configPath))
     throw new GodotMCPError("No project.godot found", "PROJECT_NOT_FOUND", "Verify the project path.");
   return configPath;
@@ -970,9 +993,9 @@ ${actionLine}`);
 
 // src/tools/composite/navigation.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 function resolveScene2(projectPath, scenePath) {
-  const fullPath = projectPath ? resolve5(projectPath, scenePath) : resolve5(scenePath);
+  const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve6(scenePath);
   if (!existsSync6(fullPath))
     throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check the file path.");
   return fullPath;
@@ -1054,7 +1077,7 @@ async function handleNavigation(action, args, config) {
 
 // src/tools/composite/nodes.ts
 import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 
 // src/tools/helpers/scene-parser.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
@@ -1293,7 +1316,7 @@ function mapToSceneNode(node) {
   };
 }
 function resolveScenePath(projectPath, scenePath) {
-  return projectPath ? resolve6(projectPath, scenePath) : resolve6(scenePath);
+  return projectPath ? safeResolve(projectPath, scenePath) : resolve7(scenePath);
 }
 async function handleNodes(action, args, config) {
   const projectPath = args.project_path || config.projectPath;
@@ -1424,7 +1447,7 @@ ${nodeDecl}`;
 
 // src/tools/composite/physics.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join4, resolve as resolve7 } from "node:path";
+import { join as join4, resolve as resolve8 } from "node:path";
 
 // src/tools/helpers/project-settings.ts
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
@@ -1531,7 +1554,7 @@ async function handlePhysics(action, args, config) {
   switch (action) {
     case "layers": {
       if (!projectPath) throw new GodotMCPError("No project path specified", "INVALID_ARGS", "Provide project_path.");
-      const configPath = join4(resolve7(projectPath), "project.godot");
+      const configPath = join4(resolve8(projectPath), "project.godot");
       if (!existsSync8(configPath))
         throw new GodotMCPError("No project.godot found", "PROJECT_NOT_FOUND", "Verify project path.");
       const settings = parseProjectSettings(configPath);
@@ -1553,7 +1576,7 @@ async function handlePhysics(action, args, config) {
       if (!nodeName) throw new GodotMCPError("No node name specified", "INVALID_ARGS", "Provide node name.");
       const collisionLayer = args.collision_layer;
       const collisionMask = args.collision_mask;
-      const fullPath = projectPath ? resolve7(projectPath, scenePath) : resolve7(scenePath);
+      const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve8(scenePath);
       if (!existsSync8(fullPath))
         throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check file path.");
       let content = readFileSync9(fullPath, "utf-8");
@@ -1579,7 +1602,7 @@ collision_mask = ${collisionMask}`;
       if (!scenePath) throw new GodotMCPError("No scene_path specified", "INVALID_ARGS", "Provide scene_path.");
       const nodeName = args.name;
       if (!nodeName) throw new GodotMCPError("No node name specified", "INVALID_ARGS", "Provide node name.");
-      const fullPath = projectPath ? resolve7(projectPath, scenePath) : resolve7(scenePath);
+      const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve8(scenePath);
       if (!existsSync8(fullPath))
         throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check file path.");
       let content = readFileSync9(fullPath, "utf-8");
@@ -1610,7 +1633,7 @@ freeze = ${args.freeze}`;
       const dimension = args.dimension || "2d";
       const name = args.name;
       if (!name) throw new GodotMCPError("No name specified", "INVALID_ARGS", "Provide layer name.");
-      const configPath = join4(resolve7(projectPath), "project.godot");
+      const configPath = join4(resolve8(projectPath), "project.godot");
       if (!existsSync8(configPath))
         throw new GodotMCPError("No project.godot found", "PROJECT_NOT_FOUND", "Verify project path.");
       const content = readFileSync9(configPath, "utf-8");
@@ -1632,7 +1655,7 @@ freeze = ${args.freeze}`;
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync9 } from "node:fs";
 import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join5, resolve as resolve8 } from "node:path";
+import { join as join5, resolve as resolve9 } from "node:path";
 async function parseProjectGodot(projectPath) {
   const configPath = join5(projectPath, "project.godot");
   if (!existsSync9(configPath)) {
@@ -1683,7 +1706,7 @@ async function handleProject(action, args, config) {
           "Provide project_path argument or set it via config.set action."
         );
       }
-      const info = await parseProjectGodot(resolve8(projectPath));
+      const info = await parseProjectGodot(resolve9(projectPath));
       return formatJSON(info);
     }
     case "version": {
@@ -1699,7 +1722,7 @@ async function handleProject(action, args, config) {
       const projectPath = args.project_path || config.projectPath;
       if (!projectPath)
         throw new GodotMCPError("No project path specified", "INVALID_ARGS", "Provide project_path argument.");
-      const { pid } = runGodotProject(config.godotPath, resolve8(projectPath));
+      const { pid } = runGodotProject(config.godotPath, resolve9(projectPath));
       return formatSuccess(`Godot project started (PID: ${pid})`);
     }
     case "stop": {
@@ -1720,7 +1743,7 @@ async function handleProject(action, args, config) {
       const key = args.key;
       if (!key)
         throw new GodotMCPError("No key specified", "INVALID_ARGS", 'Provide key (e.g., "application/config/name").');
-      const configPath = join5(resolve8(projectPath), "project.godot");
+      const configPath = join5(resolve9(projectPath), "project.godot");
       if (!existsSync9(configPath))
         throw new GodotMCPError("No project.godot found", "PROJECT_NOT_FOUND", "Verify the project path.");
       const settings = await parseProjectSettingsAsync(configPath);
@@ -1734,7 +1757,7 @@ async function handleProject(action, args, config) {
       const value = args.value;
       if (!key || value === void 0)
         throw new GodotMCPError("key and value required", "INVALID_ARGS", "Provide key and value.");
-      const configPath = join5(resolve8(projectPath), "project.godot");
+      const configPath = join5(resolve9(projectPath), "project.godot");
       if (!existsSync9(configPath))
         throw new GodotMCPError("No project.godot found", "PROJECT_NOT_FOUND", "Verify the project path.");
       const content = await readFile2(configPath, "utf-8");
@@ -1759,10 +1782,10 @@ async function handleProject(action, args, config) {
       const result = execGodotSync(config.godotPath, [
         "--headless",
         "--path",
-        resolve8(projectPath),
+        resolve9(projectPath),
         "--export-release",
         preset,
-        resolve8(projectPath, outputPath)
+        safeResolve(projectPath, outputPath)
       ]);
       return formatSuccess(`Export complete: ${outputPath}
 ${result.stdout}`);
@@ -1778,12 +1801,11 @@ ${result.stdout}`);
 
 // src/tools/composite/resources.ts
 import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync10, statSync, unlinkSync } from "node:fs";
-import { extname, join as join6, relative, resolve as resolve9 } from "node:path";
+import { extname, join as join6, relative as relative2, resolve as resolve10 } from "node:path";
 var RESOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".tres",
   ".res",
   ".tscn",
-  ".tscn",
   ".png",
   ".jpg",
   ".jpeg",
@@ -1798,19 +1820,17 @@ var RESOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".gdshaderinc",
   ".import"
 ]);
-function findResourceFiles(dir, extensions) {
+function findResourceFiles(dir, extensions, results = []) {
   const exts = extensions || RESOURCE_EXTENSIONS;
-  const results = [];
   try {
-    const entries = readdirSync2(dir);
+    const entries = readdirSync2(dir, { withFileTypes: true });
     for (const entry of entries) {
-      if (entry.startsWith(".") || entry === "node_modules" || entry === "build") continue;
-      const fullPath = join6(dir, entry);
-      const stat = statSync(fullPath);
-      if (stat.isDirectory()) {
-        results.push(...findResourceFiles(fullPath, exts));
-      } else if (exts.has(extname(entry).toLowerCase())) {
-        results.push({ path: fullPath, size: stat.size });
+      if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "build") continue;
+      const fullPath = join6(dir, entry.name);
+      if (entry.isDirectory()) {
+        findResourceFiles(fullPath, exts, results);
+      } else if (exts.has(extname(entry.name).toLowerCase())) {
+        results.push({ path: fullPath, size: statSync(fullPath).size });
       }
     }
   } catch {
@@ -1822,7 +1842,7 @@ async function handleResources(action, args, config) {
   switch (action) {
     case "list": {
       if (!projectPath) throw new GodotMCPError("No project path specified", "INVALID_ARGS", "Provide project_path.");
-      const resolvedPath = resolve9(projectPath);
+      const resolvedPath = resolve10(projectPath);
       const filterType = args.type;
       let exts;
       if (filterType) {
@@ -1838,7 +1858,7 @@ async function handleResources(action, args, config) {
       }
       const resources = findResourceFiles(resolvedPath, exts);
       const relativePaths = resources.map((r) => ({
-        path: relative(resolvedPath, r.path).replace(/\\/g, "/"),
+        path: relative2(resolvedPath, r.path).replace(/\\/g, "/"),
         ext: extname(r.path),
         size: r.size
       }));
@@ -1847,7 +1867,7 @@ async function handleResources(action, args, config) {
     case "info": {
       const resPath = args.resource_path;
       if (!resPath) throw new GodotMCPError("No resource_path specified", "INVALID_ARGS", "Provide resource_path.");
-      const fullPath = projectPath ? resolve9(projectPath, resPath) : resolve9(resPath);
+      const fullPath = projectPath ? safeResolve(projectPath, resPath) : resolve10(resPath);
       if (!existsSync10(fullPath))
         throw new GodotMCPError(`Resource not found: ${resPath}`, "RESOURCE_ERROR", "Check the file path.");
       const stat = statSync(fullPath);
@@ -1870,7 +1890,7 @@ async function handleResources(action, args, config) {
     case "delete": {
       const resPath = args.resource_path;
       if (!resPath) throw new GodotMCPError("No resource_path specified", "INVALID_ARGS", "Provide resource_path.");
-      const fullPath = projectPath ? resolve9(projectPath, resPath) : resolve9(resPath);
+      const fullPath = projectPath ? safeResolve(projectPath, resPath) : resolve10(resPath);
       if (!existsSync10(fullPath))
         throw new GodotMCPError(`Resource not found: ${resPath}`, "RESOURCE_ERROR", "Check the file path.");
       unlinkSync(fullPath);
@@ -1881,7 +1901,7 @@ async function handleResources(action, args, config) {
     case "import_config": {
       const resPath = args.resource_path;
       if (!resPath) throw new GodotMCPError("No resource_path specified", "INVALID_ARGS", "Provide resource_path.");
-      const importPath = projectPath ? resolve9(projectPath, `${resPath}.import`) : resolve9(`${resPath}.import`);
+      const importPath = projectPath ? safeResolve(projectPath, `${resPath}.import`) : resolve10(`${resPath}.import`);
       if (!existsSync10(importPath)) {
         return formatJSON({ path: resPath, imported: false, message: "No .import file found." });
       }
@@ -1900,18 +1920,9 @@ ${content}`);
 }
 
 // src/tools/composite/scenes.ts
-import {
-  copyFileSync,
-  existsSync as existsSync11,
-  mkdirSync,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync11,
-  statSync as statSync2,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync9
-} from "node:fs";
+import { copyFileSync, existsSync as existsSync11, mkdirSync, readdirSync as readdirSync3, readFileSync as readFileSync11, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
-import { basename, dirname, extname as extname2, join as join7, relative as relative2, resolve as resolve10 } from "node:path";
+import { basename, dirname, extname as extname2, join as join7, relative as relative3, resolve as resolve11 } from "node:path";
 async function parseTscnFile(filePath) {
   const content = await readFile3(filePath, "utf-8");
   const lines = content.split("\n");
@@ -1951,18 +1962,15 @@ async function parseTscnFile(filePath) {
   }
   return { path: filePath, rootNode, rootType, nodeCount: nodes.length, nodes, resources };
 }
-function findSceneFiles(dir) {
-  const results = [];
+function findSceneFiles(dir, results = []) {
   try {
-    const entries = readdirSync3(dir);
+    const entries = readdirSync3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      if (entry.startsWith(".") || entry === "node_modules" || entry === "build") continue;
-      const fullPath = join7(dir, entry);
-      const stat = statSync2(fullPath);
-      if (stat.isDirectory()) {
-        results.push(...findSceneFiles(fullPath));
-      } else if (extname2(entry) === ".tscn") {
-        results.push(fullPath);
+      if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "build") continue;
+      if (entry.isDirectory()) {
+        findSceneFiles(join7(dir, entry.name), results);
+      } else if (extname2(entry.name) === ".tscn") {
+        results.push(join7(dir, entry.name));
       }
     }
   } catch {
@@ -1992,8 +2000,9 @@ function validateSceneArgs(action, args, config) {
   }
   return { projectPath, scenePath, newPath };
 }
-function resolvePath(base, relative6) {
-  return base ? resolve10(base, relative6) : resolve10(relative6);
+function resolvePath(base, relativePath) {
+  if (base) return safeResolve(base, relativePath);
+  return resolve11(relativePath);
 }
 async function handleScenes(action, args, config) {
   const { projectPath, scenePath, newPath } = validateSceneArgs(action, args, config);
@@ -2001,7 +2010,7 @@ async function handleScenes(action, args, config) {
     case "create": {
       const rootType = args.root_type || "Node2D";
       const rootName = args.root_name || basename(scenePath, ".tscn");
-      const fullPath = resolve10(projectPath, scenePath);
+      const fullPath = resolve11(projectPath, scenePath);
       if (existsSync11(fullPath)) {
         throw new GodotMCPError(
           `Scene already exists: ${scenePath}`,
@@ -2016,9 +2025,9 @@ async function handleScenes(action, args, config) {
 Root: ${rootName} (${rootType})`);
     }
     case "list": {
-      const resolvedPath = resolve10(projectPath);
+      const resolvedPath = resolve11(projectPath);
       const scenes = findSceneFiles(resolvedPath);
-      const relativePaths = scenes.map((s) => relative2(resolvedPath, s).replace(/\\/g, "/"));
+      const relativePaths = scenes.map((s) => relative3(resolvedPath, s).replace(/\\/g, "/"));
       return formatJSON({
         project: resolvedPath,
         count: relativePaths.length,
@@ -2059,7 +2068,7 @@ Root: ${rootName} (${rootType})`);
       return formatSuccess(`Duplicated: ${scenePath} -> ${newPath}`);
     }
     case "set_main": {
-      const configPath = join7(resolve10(projectPath), "project.godot");
+      const configPath = join7(resolve11(projectPath), "project.godot");
       if (!existsSync11(configPath)) {
         throw new GodotMCPError("No project.godot found", "PROJECT_NOT_FOUND", "Verify the project path.");
       }
@@ -2079,26 +2088,8 @@ Root: ${rootName} (${rootType})`);
 }
 
 // src/tools/composite/scripts.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync2, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync2, readdirSync as readdirSync4, readFileSync as readFileSync12, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname2, extname as extname3, join as join8, relative as relative4, resolve as resolve12 } from "node:path";
-
-// src/tools/helpers/paths.ts
-import { isAbsolute, relative as relative3, resolve as resolve11 } from "node:path";
-function safeResolve(baseDir, targetPath) {
-  const resolvedBase = resolve11(baseDir);
-  const resolvedTarget = resolve11(resolvedBase, targetPath);
-  const relativePath = relative3(resolvedBase, resolvedTarget);
-  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
-    throw new GodotMCPError(
-      `Access denied: Path '${targetPath}' resolves to '${resolvedTarget}' which is outside the project root '${resolvedBase}'.`,
-      "INVALID_ARGS",
-      "Ensure all file paths are within the project directory."
-    );
-  }
-  return resolvedTarget;
-}
-
-// src/tools/composite/scripts.ts
 var SCRIPT_TEMPLATES = {
   Node: `extends Node
 
@@ -2192,15 +2183,14 @@ func _ready() -> void:
 }
 function findScriptFiles(dir, results = []) {
   try {
-    const entries = readdirSync4(dir);
+    const entries = readdirSync4(dir, { withFileTypes: true });
     for (const entry of entries) {
-      if (entry.startsWith(".") || entry === "node_modules" || entry === "build" || entry === "addons") continue;
-      const fullPath = join8(dir, entry);
-      const stat = statSync3(fullPath);
-      if (stat.isDirectory()) {
-        findScriptFiles(fullPath, results);
-      } else if (extname3(entry) === ".gd") {
-        results.push(fullPath);
+      if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "build" || entry.name === "addons")
+        continue;
+      if (entry.isDirectory()) {
+        findScriptFiles(join8(dir, entry.name), results);
+      } else if (extname3(entry.name) === ".gd") {
+        results.push(join8(dir, entry.name));
       }
     }
   } catch {
@@ -2443,7 +2433,7 @@ async function handleShader(action, args, config) {
         );
       const shaderType = args.shader_type || "canvas_item";
       const content = args.content || SHADER_TEMPLATES[shaderType] || SHADER_TEMPLATES.canvas_item;
-      const fullPath = projectPath ? resolve13(projectPath, shaderPath) : resolve13(shaderPath);
+      const fullPath = projectPath ? safeResolve(projectPath, shaderPath) : resolve13(shaderPath);
       await mkdir(dirname3(fullPath), { recursive: true });
       try {
         await writeFile3(fullPath, content, { encoding: "utf-8", flag: "wx" });
@@ -2458,7 +2448,7 @@ async function handleShader(action, args, config) {
     case "read": {
       const shaderPath = args.shader_path;
       if (!shaderPath) throw new GodotMCPError("No shader_path specified", "INVALID_ARGS", "Provide shader_path.");
-      const fullPath = projectPath ? resolve13(projectPath, shaderPath) : resolve13(shaderPath);
+      const fullPath = projectPath ? safeResolve(projectPath, shaderPath) : resolve13(shaderPath);
       try {
         const content = await readFile4(fullPath, "utf-8");
         return formatSuccess(`File: ${shaderPath}
@@ -2476,7 +2466,7 @@ ${content}`);
       if (!shaderPath) throw new GodotMCPError("No shader_path specified", "INVALID_ARGS", "Provide shader_path.");
       const content = args.content;
       if (!content) throw new GodotMCPError("No content specified", "INVALID_ARGS", "Provide shader content.");
-      const fullPath = projectPath ? resolve13(projectPath, shaderPath) : resolve13(shaderPath);
+      const fullPath = projectPath ? safeResolve(projectPath, shaderPath) : resolve13(shaderPath);
       await mkdir(dirname3(fullPath), { recursive: true });
       await writeFile3(fullPath, content, "utf-8");
       return formatSuccess(`Written: ${shaderPath} (${content.length} chars)`);
@@ -2484,7 +2474,7 @@ ${content}`);
     case "get_params": {
       const shaderPath = args.shader_path;
       if (!shaderPath) throw new GodotMCPError("No shader_path specified", "INVALID_ARGS", "Provide shader_path.");
-      const fullPath = projectPath ? resolve13(projectPath, shaderPath) : resolve13(shaderPath);
+      const fullPath = projectPath ? safeResolve(projectPath, shaderPath) : resolve13(shaderPath);
       try {
         const content = await readFile4(fullPath, "utf-8");
         const params = [];
@@ -2533,7 +2523,7 @@ async function handleSignals(action, args, config) {
   const projectPath = args.project_path || config.projectPath;
   const scenePath = args.scene_path;
   if (!scenePath) throw new GodotMCPError("No scene_path specified", "INVALID_ARGS", "Provide scene_path.");
-  const fullPath = projectPath ? resolve14(projectPath, scenePath) : resolve14(scenePath);
+  const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve14(scenePath);
   async function readScene() {
     try {
       return await readFile5(fullPath, "utf-8");
@@ -2647,7 +2637,7 @@ async function handleTilemap(action, args, config) {
           'Provide tileset_path (e.g., "tilesets/main.tres").'
         );
       const tileSize = args.tile_size || 16;
-      const fullPath = projectPath ? resolve15(projectPath, tilesetPath) : resolve15(tilesetPath);
+      const fullPath = projectPath ? safeResolve(projectPath, tilesetPath) : resolve15(tilesetPath);
       if (existsSync14(fullPath)) {
         throw new GodotMCPError(`TileSet already exists: ${tilesetPath}`, "TILEMAP_ERROR", "Use a different path.");
       }
@@ -2669,7 +2659,7 @@ async function handleTilemap(action, args, config) {
       if (!tilesetPath || !texturePath) {
         throw new GodotMCPError("tileset_path and texture_path required", "INVALID_ARGS", "Both are required.");
       }
-      const fullPath = projectPath ? resolve15(projectPath, tilesetPath) : resolve15(tilesetPath);
+      const fullPath = projectPath ? safeResolve(projectPath, tilesetPath) : resolve15(tilesetPath);
       if (!existsSync14(fullPath))
         throw new GodotMCPError(`TileSet not found: ${tilesetPath}`, "TILEMAP_ERROR", "Create the tileset first.");
       let content = readFileSync13(fullPath, "utf-8");
@@ -2699,7 +2689,7 @@ async function handleTilemap(action, args, config) {
     case "list": {
       const scenePath = args.scene_path;
       if (!scenePath) throw new GodotMCPError("No scene_path specified", "INVALID_ARGS", "Provide scene_path.");
-      const fullPath = projectPath ? resolve15(projectPath, scenePath) : resolve15(scenePath);
+      const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve15(scenePath);
       if (!existsSync14(fullPath))
         throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check the file path.");
       const content = readFileSync13(fullPath, "utf-8");
@@ -2743,7 +2733,7 @@ var CONTROL_TEMPLATES = {
   GridContainer: { columns: "2" }
 };
 function resolveScene3(projectPath, scenePath) {
-  const fullPath = projectPath ? resolve16(projectPath, scenePath) : resolve16(scenePath);
+  const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve16(scenePath);
   if (!existsSync15(fullPath))
     throw new GodotMCPError(`Scene not found: ${scenePath}`, "SCENE_ERROR", "Check the file path.");
   return fullPath;
@@ -2791,7 +2781,7 @@ ${nodeDecl}`;
           "INVALID_ARGS",
           'Provide theme_path (e.g., "themes/main.tres").'
         );
-      const fullPath = projectPath ? resolve16(projectPath, themePath) : resolve16(themePath);
+      const fullPath = projectPath ? safeResolve(projectPath, themePath) : resolve16(themePath);
       const fontSize = args.font_size || 16;
       const _fontColor = args.font_color || "Color(1, 1, 1, 1)";
       const _bgColor = args.bg_color || "Color(0.15, 0.15, 0.15, 1)";

package/build/src/tools/composite/animation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"animation.d.ts","sourceRoot":"","sources":["../../../../src/tools/composite/animation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAUvD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW;;;;;GAuIvG"}
+{"version":3,"file":"animation.d.ts","sourceRoot":"","sources":["../../../../src/tools/composite/animation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAWvD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW;;;;;GAuIvG"}

package/build/src/tools/composite/animation.js

@@ -5,8 +5,9 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { formatJSON, formatSuccess, GodotMCPError } from '../helpers/errors.js';
+import { safeResolve } from '../helpers/paths.js';
 function resolveScene(projectPath, scenePath) {
-    const fullPath = projectPath ? resolve(projectPath, scenePath) : resolve(scenePath);
+    const fullPath = projectPath ? safeResolve(projectPath, scenePath) : resolve(scenePath);
     if (!existsSync(fullPath))
         throw new GodotMCPError(`Scene not found: ${scenePath}`, 'SCENE_ERROR', 'Check the file path.');
     return fullPath;