@vizejs/musea-mcp-server 0.81.0 → 0.83.0

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as startServer } from "./src-Cp5GZpzj.mjs";
+import { n as startServer } from "./src-BrRHhfXh.mjs";
 //#region src/cli.ts
 /**
 * Musea MCP Server CLI.

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { n as startServer, t as createMuseaServer } from "./src-Cp5GZpzj.mjs";
+import { n as startServer, t as createMuseaServer } from "./src-BrRHhfXh.mjs";
 export { createMuseaServer, createMuseaServer as default, startServer };

package/dist/{src-Cp5GZpzj.mjs → src-BrRHhfXh.mjs}

@@ -495,9 +495,36 @@ function tokenize(query) {
 	return Array.from(new Set(query.toLowerCase().split(/[\s/,_-]+/).map((term) => term.trim()).filter(Boolean)));
 }
 function toProjectPath(projectRoot, absolutePath) {
-	const relativePath = path.relative(projectRoot, absolutePath);
-	if (!relativePath || relativePath.startsWith("..") || path.isAbsolute(relativePath)) return absolutePath;
-	return relativePath;
+	const root = realpathNearest(projectRoot);
+	const resolved = realpathNearest(absolutePath);
+	const relativePath = path.relative(root, resolved);
+	return isProjectPath(root, resolved) ? relativePath || "." : resolved;
+}
+function realpathNearest(targetPath) {
+	let current = path.resolve(targetPath);
+	const missingParts = [];
+	while (true) try {
+		const real = fs.realpathSync.native(current);
+		return missingParts.length > 0 ? path.join(real, ...missingParts.reverse()) : real;
+	} catch {
+		const parent = path.dirname(current);
+		if (parent === current) return path.resolve(targetPath);
+		missingParts.push(path.basename(current));
+		current = parent;
+	}
+}
+function isProjectPath(projectRoot, candidatePath) {
+	const root = realpathNearest(projectRoot);
+	const candidate = realpathNearest(candidatePath);
+	const relativePath = path.relative(root, candidate);
+	return relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+}
+function resolveProjectPath(projectRoot, inputPath, label = "path") {
+	if (inputPath.includes("\0")) throw new McpError(ErrorCode.InvalidParams, `${label} contains an invalid character`);
+	const root = path.resolve(projectRoot);
+	const resolvedPath = path.isAbsolute(inputPath) ? path.resolve(inputPath) : path.resolve(root, inputPath);
+	if (!isProjectPath(root, resolvedPath)) throw new McpError(ErrorCode.InvalidParams, `${label} must stay inside the project root`);
+	return resolvedPath;
 }
 function buildResourceUris$1(relativePath, variantNames, hasComponentSource) {
 	const encodedPath = encodeURIComponent(relativePath);
@@ -628,7 +655,7 @@ async function resolveArtReference(ctx, args) {
 	const queryArg = typeof args?.query === "string" ? args.query : void 0;
 	const refArg = typeof args?.ref === "string" ? args.ref : void 0;
 	if (pathArg) {
-		const resolvedPath = path.isAbsolute(pathArg) ? pathArg : path.resolve(ctx.projectRoot, pathArg);
+		const resolvedPath = resolveProjectPath(ctx.projectRoot, pathArg, "path");
 		const normalizedResolvedPath = normalizePathLike(resolvedPath);
 		const normalizedRelativePath = normalizePathLike(path.relative(ctx.projectRoot, resolvedPath));
 		const directMatch = arts.find((info) => {
@@ -719,6 +746,13 @@ async function getComponentSourceDescriptor(ctx, resolved) {
 		exists: false,
 		error: "This art file does not declare a component source."
 	};
+	if (!isProjectPath(ctx.projectRoot, componentPath)) return {
+		reference: resolved.info.component,
+		absolutePath: componentPath,
+		path: componentPath,
+		exists: false,
+		error: "Component source is outside the project root."
+	};
 	try {
 		await fs.promises.access(componentPath, fs.constants.R_OK);
 		return {
@@ -977,7 +1011,7 @@ async function handleAnalyzeComponent(ctx, binding, args) {
 	const directPath = args?.path;
 	if (directPath?.endsWith(".vue") && !directPath.endsWith(".art.vue")) {
 		if (!binding.analyzeSfc) throw new McpError(ErrorCode.InternalError, "analyzeSfc not available in native binding");
-		const absolutePath = path.resolve(ctx.projectRoot, directPath);
+		const absolutePath = resolveProjectPath(ctx.projectRoot, directPath, "path");
 		const source = await fs.promises.readFile(absolutePath, "utf-8");
 		const analysis = binding.analyzeSfc(source, { filename: absolutePath });
 		return { content: [{
@@ -1344,7 +1378,7 @@ async function handleGenerateVariants(ctx, binding, args) {
 	if (!componentRelPath) throw new McpError(ErrorCode.InvalidParams, "componentPath is required");
 	if (!binding.analyzeSfc) throw new McpError(ErrorCode.InternalError, "analyzeSfc not available in native binding");
 	if (!binding.generateVariants) throw new McpError(ErrorCode.InternalError, "generateVariants not available in native binding");
-	const absolutePath = path.resolve(ctx.projectRoot, componentRelPath);
+	const absolutePath = resolveProjectPath(ctx.projectRoot, componentRelPath, "componentPath");
 	const source = await fs.promises.readFile(absolutePath, "utf-8");
 	const props = binding.analyzeSfc(source, { filename: absolutePath }).props.map((prop) => ({
 		name: prop.name,
@@ -1469,7 +1503,7 @@ async function handleGetTokens(ctx, args) {
 	const inputPath = args?.tokensPath;
 	const format = args?.format ?? "json";
 	let resolvedPath;
-	if (inputPath) resolvedPath = path.resolve(ctx.projectRoot, inputPath);
+	if (inputPath) resolvedPath = resolveProjectPath(ctx.projectRoot, inputPath, "tokensPath");
 	else resolvedPath = await ctx.resolveTokensPath();
 	if (!resolvedPath) throw new McpError(ErrorCode.InvalidParams, "No tokens path provided and none auto-detected. Looked for: tokens/, design-tokens/, style-dictionary/ directories.");
 	const categories = await parseTokensFromPath(resolvedPath);
@@ -1494,7 +1528,7 @@ async function handleSearchTokens(ctx, args) {
 	const inputPath = args?.tokensPath;
 	const typeFilter = typeof args?.type === "string" ? args.type.toLowerCase() : void 0;
 	const limit = typeof args?.limit === "number" ? args.limit : 20;
-	const resolvedPath = inputPath ? path.resolve(ctx.projectRoot, inputPath) : await ctx.resolveTokensPath();
+	const resolvedPath = inputPath ? resolveProjectPath(ctx.projectRoot, inputPath, "tokensPath") : await ctx.resolveTokensPath();
 	if (!resolvedPath) throw new McpError(ErrorCode.InvalidParams, "No tokens path provided and none auto-detected. Looked for: tokens/, design-tokens/, style-dictionary/ directories.");
 	const flattened = flattenTokenCategories(await parseTokensFromPath(resolvedPath));
 	const normalizedQuery = query.toLowerCase();
@@ -1672,7 +1706,7 @@ async function readResource(ctx, uri) {
 	}
 	if (uri.startsWith("musea://source/")) {
 		const relativePath = decodeURIComponent(uri.slice(15));
-		const absolutePath = path.resolve(ctx.projectRoot, relativePath);
+		const absolutePath = resolveProjectPath(ctx.projectRoot, relativePath, "source path");
 		return { contents: [{
 			uri,
 			mimeType: "text/plain",
@@ -1687,7 +1721,7 @@ async function readResource(ctx, uri) {
 			includeDocumentation: false
 		})).componentSource;
 		if (!componentSource?.path || componentSource.exists !== true) throw new McpError(ErrorCode.InvalidRequest, componentSource?.error ?? "Component source not available for this art file");
-		const absolutePath = path.resolve(ctx.projectRoot, componentSource.path);
+		const absolutePath = resolveProjectPath(ctx.projectRoot, componentSource.path, "component source path");
 		return { contents: [{
 			uri,
 			mimeType: "text/plain",
@@ -1766,7 +1800,7 @@ function createMuseaServer(config) {
 		resources: {},
 		tools: {}
 	} });
-	const projectRoot = config.projectRoot;
+	const projectRoot = path.resolve(config.projectRoot);
 	const include = config.include ?? ["**/*.art.vue"];
 	const exclude = config.exclude ?? ["node_modules/**", "dist/**"];
 	const tokensPath = config.tokensPath;
@@ -1801,7 +1835,7 @@ function createMuseaServer(config) {
 		return artCache;
 	}
 	async function resolveTokensPath() {
-		if (tokensPath) return path.resolve(projectRoot, tokensPath);
+		if (tokensPath) return resolveProjectPath(projectRoot, tokensPath, "tokensPath");
 		for (const dir of [
 			"tokens",
 			"design-tokens",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizejs/musea-mcp-server",
-  "version": "0.81.0",
+  "version": "0.83.0",
   "description": "MCP server for building Vue.js design systems - component analysis, documentation, variant generation, and design tokens",
   "keywords": [
     "ai",
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@vizejs/native": "0.81.0"
+    "@vizejs/native": "0.83.0"
   },
   "devDependencies": {
     "@tsdown/css": "0.22.0",