@vizejs/musea-mcp-server 0.390.0 → 0.404.8

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as startServer } from "./src-BrLbwFKO.mjs";
+import { n as startServer } from "./src-BB93rq2Q.mjs";
 //#region src/cli.ts
 /**
 * Musea MCP Server CLI.

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { n as startServer, t as createMuseaServer } from "./src-BrLbwFKO.mjs";
+import { n as startServer, t as createMuseaServer } from "./src-BB93rq2Q.mjs";
 export { createMuseaServer, createMuseaServer as default, startServer };

package/dist/{src-BrLbwFKO.mjs → src-BB93rq2Q.mjs}

@@ -19,6 +19,101 @@ function loadNative() {
 	}
 }
 //#endregion
+//#region src/vue-source-path.ts
+/**
+* Confine MCP component reads to real `.vue` files.
+*
+* Request paths that merely *end with* `.vue` are not enough: a planted
+* `Evil.vue` → `.env` symlink would otherwise be read by generate/analyze
+* and by art-declared component sources.
+*/
+function realpathNearest$2(targetPath) {
+	let current = path.resolve(targetPath);
+	const missingParts = [];
+	while (true) try {
+		const real = fs.realpathSync.native(current);
+		return missingParts.length > 0 ? path.join(real, ...missingParts.reverse()) : real;
+	} catch {
+		const parent = path.dirname(current);
+		if (parent === current) return path.resolve(targetPath);
+		missingParts.push(path.basename(current));
+		current = parent;
+	}
+}
+function isVueSourcePath(candidatePath) {
+	return realpathNearest$2(candidatePath).toLowerCase().endsWith(".vue");
+}
+function assertVueSourcePath(candidatePath, label = "path") {
+	if (!isVueSourcePath(candidatePath)) throw new McpError(ErrorCode.InvalidParams, `${label} must be a .vue file`);
+}
+//#endregion
+//#region src/component-source-descriptor.ts
+function realpathNearest$1(targetPath) {
+	let current = path.resolve(targetPath);
+	const missingParts = [];
+	while (true) try {
+		const real = fs.realpathSync.native(current);
+		return missingParts.length > 0 ? path.join(real, ...missingParts.reverse()) : real;
+	} catch {
+		const parent = path.dirname(current);
+		if (parent === current) return path.resolve(targetPath);
+		missingParts.push(path.basename(current));
+		current = parent;
+	}
+}
+function isProjectPath$1(projectRoot, candidatePath) {
+	const root = realpathNearest$1(projectRoot);
+	const candidate = realpathNearest$1(candidatePath);
+	const relativePath = path.relative(root, candidate);
+	return relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+}
+function toProjectPath$1(projectRoot, absolutePath) {
+	const root = realpathNearest$1(projectRoot);
+	const resolved = realpathNearest$1(absolutePath);
+	const relativePath = path.relative(root, resolved);
+	return isProjectPath$1(root, resolved) ? relativePath || "." : resolved;
+}
+function resolveComponentSourcePath(artAbsolutePath, componentReference) {
+	if (!componentReference) return null;
+	if (path.isAbsolute(componentReference)) return componentReference;
+	return path.resolve(path.dirname(artAbsolutePath), componentReference);
+}
+async function getComponentSourceDescriptor(ctx, resolved) {
+	const componentPath = resolveComponentSourcePath(resolved.absolutePath, resolved.info.component);
+	if (!componentPath) return {
+		reference: resolved.info.component,
+		exists: false,
+		error: "This art file does not declare a component source."
+	};
+	if (!isProjectPath$1(ctx.projectRoot, componentPath)) return {
+		reference: resolved.info.component,
+		exists: false,
+		error: "Component source is outside the project root."
+	};
+	if (!isVueSourcePath(componentPath)) return {
+		reference: resolved.info.component,
+		exists: false,
+		error: "Component source must be a .vue file."
+	};
+	try {
+		await fs.promises.access(componentPath, fs.constants.R_OK);
+		return {
+			reference: resolved.info.component,
+			absolutePath: componentPath,
+			path: toProjectPath$1(ctx.projectRoot, componentPath),
+			exists: true
+		};
+	} catch {
+		return {
+			reference: resolved.info.component,
+			absolutePath: componentPath,
+			path: toProjectPath$1(ctx.projectRoot, componentPath),
+			exists: false,
+			error: `Component source not found: ${toProjectPath$1(ctx.projectRoot, componentPath)}`
+		};
+	}
+}
+//#endregion
 //#region src/markdown-template.ts
 const SELF_TAG_NAME = "Self";
 const TEMPLATE_FENCE_LANGUAGES = new Set([
@@ -352,41 +447,6 @@ async function resolveArtReference(ctx, args) {
 		alternatives: buildAlternatives(results)
 	};
 }
-function resolveComponentSourcePath(artAbsolutePath, componentReference) {
-	if (!componentReference) return null;
-	if (path.isAbsolute(componentReference)) return componentReference;
-	return path.resolve(path.dirname(artAbsolutePath), componentReference);
-}
-async function getComponentSourceDescriptor(ctx, resolved) {
-	const componentPath = resolveComponentSourcePath(resolved.absolutePath, resolved.info.component);
-	if (!componentPath) return {
-		reference: resolved.info.component,
-		exists: false,
-		error: "This art file does not declare a component source."
-	};
-	if (!isProjectPath(ctx.projectRoot, componentPath)) return {
-		reference: resolved.info.component,
-		exists: false,
-		error: "Component source is outside the project root."
-	};
-	try {
-		await fs.promises.access(componentPath, fs.constants.R_OK);
-		return {
-			reference: resolved.info.component,
-			absolutePath: componentPath,
-			path: toProjectPath(ctx.projectRoot, componentPath),
-			exists: true
-		};
-	} catch {
-		return {
-			reference: resolved.info.component,
-			absolutePath: componentPath,
-			path: toProjectPath(ctx.projectRoot, componentPath),
-			exists: false,
-			error: `Component source not found: ${toProjectPath(ctx.projectRoot, componentPath)}`
-		};
-	}
-}
 function normalizeDefaultValue(value) {
 	if (value === "true") return true;
 	if (value === "false") return false;
@@ -1121,6 +1181,7 @@ async function handleAnalyzeComponent(ctx, binding, args) {
 	if (directPath?.endsWith(".vue") && !directPath.endsWith(".art.vue")) {
 		if (!binding.analyzeSfc) throw new McpError(ErrorCode.InternalError, "analyzeSfc not available in native binding");
 		const absolutePath = resolveProjectPath(ctx.projectRoot, directPath, "path");
+		assertVueSourcePath(absolutePath, "path");
 		const source = await fs.promises.readFile(absolutePath, "utf-8");
 		const analysis = binding.analyzeSfc(source, { filename: absolutePath });
 		return { content: [{
@@ -1400,10 +1461,10 @@ function normalizeCategories(categories) {
 async function handleGenerateVariants(ctx, binding, args) {
 	const componentRelPath = args?.componentPath;
 	if (!componentRelPath) throw new McpError(ErrorCode.InvalidParams, "componentPath is required");
-	if (!componentRelPath.endsWith(".vue")) throw new McpError(ErrorCode.InvalidParams, "componentPath must be a .vue file");
+	const absolutePath = resolveProjectPath(ctx.projectRoot, componentRelPath, "componentPath");
+	assertVueSourcePath(absolutePath, "componentPath");
 	if (!binding.analyzeSfc) throw new McpError(ErrorCode.InternalError, "analyzeSfc not available in native binding");
 	if (!binding.generateVariants) throw new McpError(ErrorCode.InternalError, "generateVariants not available in native binding");
-	const absolutePath = resolveProjectPath(ctx.projectRoot, componentRelPath, "componentPath");
 	const source = await fs.promises.readFile(absolutePath, "utf-8");
 	const props = binding.analyzeSfc(source, { filename: absolutePath }).props.map((prop) => ({
 		name: prop.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizejs/musea-mcp-server",
-  "version": "0.390.0",
+  "version": "0.404.8",
   "description": "MCP server for building Vue.js design systems - component analysis, documentation, variant generation, and design tokens",
   "keywords": [
     "ai",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@vizejs/native": "0.390.0",
+    "@vizejs/native": "0.404.8",
     "@vue/compiler-dom": "3.5.35",
     "typescript": "6.0.3"
   },