@systemdox/mcp-server 0.1.55 → 0.1.57

package/dist/setup-team.js

@@ -59,6 +59,17 @@ var SystemDoxApiError = class extends Error {
   code;
   body;
 };
+function unescapedPath(path) {
+  let current = path.split(/[?#]/, 1)[0];
+  for (; ; ) {
+    const next = current.replace(/[\t\n\r]/g, "").replace(/%(?:2e|2f|5c|25|09|0a|0d)/gi, (escape) => decodeURIComponent(escape));
+    if (next === current) return current;
+    current = next;
+  }
+}
+function walksThePath(path) {
+  return unescapedPath(path).split(/[/\\]/).some((segment) => segment === "." || segment === "..");
+}
 var TEAM_SETUP = "/v1/team-setup";
 var seg = (s) => encodeURIComponent(String(s));
 var SystemDoxApiClient = class {
@@ -94,7 +105,7 @@ var SystemDoxApiClient = class {
   }
   async mutate(method, path, body) {
     const url = this.buildUrl(path);
-    const res = await fetch(url, {
+    const res = await this.call(url, {
       method,
       headers: {
         // The API Gateway authorizer only reads the Authorization header;
@@ -144,7 +155,7 @@ var SystemDoxApiClient = class {
   /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
    * header. The caller checks the BYTES against the hash it was given. */
   async getPluginZip(workspace, version) {
-    const res = await fetch(
+    const res = await this.call(
       this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
       {
         headers: {
@@ -210,6 +221,10 @@ var SystemDoxApiClient = class {
   buildUrl(path, params) {
     const base = this.config.apiUrl.replace(/\/+$/, "");
     const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+    const { origin, pathname } = new URL(base);
+    if (walksThePath(path) || url.origin !== origin || !url.pathname.startsWith(`${pathname.replace(/\/+$/, "")}/`)) {
+      throw new Error("Refused: this id leaves the API's own path.");
+    }
     if (params) {
       for (const [key, value] of Object.entries(params)) {
         url.searchParams.set(key, value);
@@ -219,7 +234,7 @@ var SystemDoxApiClient = class {
   }
   async fetchRaw(path, params, signal) {
     const url = this.buildUrl(path, params);
-    return fetch(url, {
+    return this.call(url, {
       headers: {
         Authorization: `Bearer ${this.config.apiKey}`,
         "X-API-Key": this.config.apiKey,
@@ -228,6 +243,16 @@ var SystemDoxApiClient = class {
       signal
     });
   }
+  /** Every call of this client, so `onAnswer` hears each answer. */
+  async call(url, init) {
+    const res = await fetch(url, init);
+    const { onAnswer } = this.config;
+    if (onAnswer) {
+      const refused = res.ok ? void 0 : new SystemDoxApiError(res.status, await res.clone().text());
+      onAnswer({ status: res.status, code: refused?.code });
+    }
+    return res;
+  }
 };
 
 // src/lib/memory-sync.ts

package/dist/sync-memory.js

@@ -56,6 +56,17 @@ var SystemDoxApiError = class extends Error {
   code;
   body;
 };
+function unescapedPath(path) {
+  let current = path.split(/[?#]/, 1)[0];
+  for (; ; ) {
+    const next = current.replace(/[\t\n\r]/g, "").replace(/%(?:2e|2f|5c|25|09|0a|0d)/gi, (escape) => decodeURIComponent(escape));
+    if (next === current) return current;
+    current = next;
+  }
+}
+function walksThePath(path) {
+  return unescapedPath(path).split(/[/\\]/).some((segment) => segment === "." || segment === "..");
+}
 var TEAM_SETUP = "/v1/team-setup";
 var seg = (s) => encodeURIComponent(String(s));
 var SystemDoxApiClient = class {
@@ -91,7 +102,7 @@ var SystemDoxApiClient = class {
   }
   async mutate(method, path, body) {
     const url = this.buildUrl(path);
-    const res = await fetch(url, {
+    const res = await this.call(url, {
       method,
       headers: {
         // The API Gateway authorizer only reads the Authorization header;
@@ -141,7 +152,7 @@ var SystemDoxApiClient = class {
   /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
    * header. The caller checks the BYTES against the hash it was given. */
   async getPluginZip(workspace, version) {
-    const res = await fetch(
+    const res = await this.call(
       this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
       {
         headers: {
@@ -207,6 +218,10 @@ var SystemDoxApiClient = class {
   buildUrl(path, params) {
     const base = this.config.apiUrl.replace(/\/+$/, "");
     const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+    const { origin, pathname } = new URL(base);
+    if (walksThePath(path) || url.origin !== origin || !url.pathname.startsWith(`${pathname.replace(/\/+$/, "")}/`)) {
+      throw new Error("Refused: this id leaves the API's own path.");
+    }
     if (params) {
       for (const [key, value] of Object.entries(params)) {
         url.searchParams.set(key, value);
@@ -216,7 +231,7 @@ var SystemDoxApiClient = class {
   }
   async fetchRaw(path, params, signal) {
     const url = this.buildUrl(path, params);
-    return fetch(url, {
+    return this.call(url, {
       headers: {
         Authorization: `Bearer ${this.config.apiKey}`,
         "X-API-Key": this.config.apiKey,
@@ -225,6 +240,16 @@ var SystemDoxApiClient = class {
       signal
     });
   }
+  /** Every call of this client, so `onAnswer` hears each answer. */
+  async call(url, init) {
+    const res = await fetch(url, init);
+    const { onAnswer } = this.config;
+    if (onAnswer) {
+      const refused = res.ok ? void 0 : new SystemDoxApiError(res.status, await res.clone().text());
+      onAnswer({ status: res.status, code: refused?.code });
+    }
+    return res;
+  }
 };
 
 // src/lib/memory-sync.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "mcpName": "io.github.puglieseweb/systemdox",
   "type": "module",
   "description": "Give AI coding agents your architecture context over MCP — checks, specs, ADRs, project rules, and docs from SystemDox, delivered at write time",
@@ -21,6 +21,11 @@
   },
   "files": [
     "dist",
+    "!dist/oauth.*",
+    "!dist/connect.*",
+    "!dist/lib/aws-deps.*",
+    "!dist/lib/connection-store.*",
+    "!dist/lib/oauth-*",
     "README.md"
   ],
   "scripts": {
@@ -68,6 +73,10 @@
     "zod": "^3.25.67"
   },
   "devDependencies": {
+    "@aws-sdk/client-dynamodb": "3.1159.0",
+    "@aws-sdk/client-kms": "3.1159.0",
+    "@aws-sdk/client-secrets-manager": "3.1159.0",
+    "@aws-sdk/lib-dynamodb": "3.1159.0",
     "@types/node": "^26.0.1",
     "esbuild": "^0.25.0",
     "tsup": "^8.5.1",