@rio-cloud/uikit-mcp 1.1.7 → 1.1.9

package/dist/index.mjs

@@ -5,7 +5,43 @@ import { z } from "zod";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import FlexSearch from "flexsearch";
-
+//#region server/lib/doc-id.ts
+var InvalidDocIdError = class extends Error {
+	constructor(id, reason) {
+		super(`Invalid doc id "${id}": ${reason}`);
+		this.name = "InvalidDocIdError";
+	}
+};
+function decodeSegment(segment, originalId) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		throw new InvalidDocIdError(originalId, `segment "${segment}" contains invalid encoding`);
+	}
+}
+function assertSafeDocId(id) {
+	if (typeof id !== "string") throw new InvalidDocIdError(String(id), "doc id must be a string");
+	const trimmed = id.trim();
+	if (!trimmed) throw new InvalidDocIdError(id, "doc id must not be empty");
+	if (trimmed.startsWith("/")) throw new InvalidDocIdError(id, "leading slash is not allowed");
+	const segments = trimmed.split("/");
+	for (const segment of segments) {
+		if (!segment.length) throw new InvalidDocIdError(id, "empty path segment is not allowed");
+		const decoded = decodeSegment(segment, id);
+		if (decoded === "." || decoded === "..") throw new InvalidDocIdError(id, "dot segments are not allowed");
+		if (decoded.includes("/") || decoded.includes("\\")) throw new InvalidDocIdError(id, "slash characters in path segments are not allowed");
+		if (decoded.includes("\0")) throw new InvalidDocIdError(id, "null bytes are not allowed");
+	}
+	return trimmed;
+}
+function resolveInsideRoot(root, relativePath) {
+	const rootPath = path.resolve(root);
+	const resolved = path.resolve(rootPath, relativePath);
+	const relative = path.relative(rootPath, resolved);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Resolved path escapes root: root="${rootPath}" relative="${relativePath}"`);
+	return resolved;
+}
+//#endregion
 //#region server/lib/load-compiled.ts
 /**
 * Runtime loading of pre-compiled documentation data.
@@ -45,17 +81,13 @@ function loadCompiledData(distRoot) {
 		version
 	};
 }
-/** Markdown path is computed: docs/${id}.md */
-function getMarkdownPath(id) {
-	return `docs/${id}.md`;
-}
 function loadMarkdown(distRoot, id) {
-	const mdPath = getMarkdownPath(id);
-	const fullPath = path.join(distRoot, mdPath);
+	const safeId = assertSafeDocId(id);
+	const fullPath = resolveInsideRoot(path.join(distRoot, "docs"), `${safeId}.md`);
+	const mdPath = path.relative(distRoot, fullPath);
 	if (!existsSync(fullPath)) throw new Error(`Markdown file not found: ${mdPath}\nExpected at: ${fullPath}\nThis may indicate an incomplete build. Run "npm run build:server" to regenerate.`);
 	return readFileSync(fullPath, "utf8");
 }
-
 //#endregion
 //#region server/lib/search-index.ts
 /**
@@ -116,11 +148,9 @@ function buildSearchIndex(entries) {
 	};
 	return { search };
 }
-
 //#endregion
 //#region package.json
-var version = "1.1.7";
-
+var version = "1.1.9";
 //#endregion
 //#region server/index.ts
 const DIST_ROOT = import.meta.dirname;
@@ -159,13 +189,14 @@ function expandDomainSynonyms(rawQuery, config) {
 }
 function registerDocResources(docs) {
 	for (const doc of docs) {
-		const uri = buildResourceUri(doc.id);
-		server.registerResource(doc.id, uri.href, {
+		const safeId = assertSafeDocId(doc.id);
+		const uri = buildResourceUri(safeId);
+		server.registerResource(safeId, uri.href, {
 			title: doc.title,
 			description: doc.summary,
 			mimeType: "text/markdown"
 		}, async () => {
-			const markdown = loadMarkdown(DIST_ROOT, doc.id);
+			const markdown = loadMarkdown(DIST_ROOT, safeId);
 			const versionNote = CAPTURED_UIKIT_VERSION ? `\n\n> Captured UI Kit version: ${CAPTURED_UIKIT_VERSION}` : "";
 			return { contents: [{
 				uri: uri.href,
@@ -272,6 +303,5 @@ main().catch((error) => {
 	console.error(error);
 	process.exit(1);
 });
-
 //#endregion
-export {  };
+export {};

package/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "2.2.0",
-  "captured_at": "2026-02-23T15:50:16.411Z"
+  "version": "2.2.1",
+  "captured_at": "2026-03-06T10:42:10.406Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rio-cloud/uikit-mcp",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "description": "MCP server that serves the captured RIO UI Kit documentation to Model Context Protocol clients.",
   "publishConfig": {
     "access": "public"
@@ -8,6 +8,10 @@
   "type": "module",
   "author": "TB Digital Services GmbH",
   "license": "Apache-2.0",
+  "engines": {
+    "node": ">=24",
+    "npm": ">=11"
+  },
   "bin": {
     "uikit-mcp": "./dist/index.mjs"
   },
@@ -17,9 +21,7 @@
   "scripts": {
     "build:server": "tsdown",
     "typecheck": "tsc --noEmit",
-    "pretest": "npm run build:server",
-    "test": "npm run typecheck && node --test --import tsx test/**/*.ts",
-    "prepack": "npm test",
+    "test": "npm run build:server && npm run typecheck && node --test --import tsx test/**/*.ts",
     "setup:crawler": "npx playwright install chromium",
     "crawl:full": "tsx tools/crawl-full.ts",
     "crawl:navigation": "tsx crawler/cli/crawl-navigation.ts",
@@ -28,15 +30,19 @@
     "mcp:server": "npm run build:server && node dist/index.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.26.0",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "flexsearch": "0.8.212",
     "zod": "4.3.6"
   },
+  "overrides": {
+    "@hono/node-server": "1.19.13",
+    "hono": "4.12.12"
+  },
   "devDependencies": {
-    "@types/node": "22.19.11",
-    "playwright": "1.58.2",
-    "tsdown": "0.20.3",
+    "@types/node": "24.12.2",
+    "playwright": "1.59.1",
+    "tsdown": "0.21.7",
     "tsx": "4.21.0",
-    "typescript": "5.9.3"
+    "typescript": "6.0.2"
   }
 }