@wrongstack/cli 0.306.3 → 0.307.0

package/dist/{mcp-JNWEQ6T2.js → mcp-CMLFHRG2.js}

@@ -38,11 +38,12 @@ var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
     return { permission: "auto", source: "default" };
   }
 };
-function parseToolsFlag(flags) {
+function parseToolsFlag(flags, positional) {
   const raw = flags["tools"];
-  if (typeof raw !== "string") return null;
+  const csv = typeof raw === "string" ? raw : raw === true ? positional?.[0] ?? "" : "";
+  if (!csv) return null;
   const set = new Set(
-    raw.split(",").map((s) => s.trim()).filter(Boolean)
+    csv.split(",").map((s) => s.trim()).filter(Boolean)
   );
   return set.size > 0 ? set : null;
 }
@@ -146,6 +147,9 @@ function mimeTypeFor(file) {
 function isTextMime(mimeType) {
   return mimeType.startsWith("text/") || mimeType === "application/json" || mimeType === "application/yaml";
 }
+function resolveServeFsRestriction(config) {
+  return config.tools?.restrictToProjectRoot ?? true;
+}
 function makeServeContext(cwd, projectRoot, signal, restrictFsToRoot = true) {
   const provider = {
     id: "mcp-serve",
@@ -187,10 +191,16 @@ async function selectExposedTools(registry, ctx, policy, whitelist) {
   }
   return allowed;
 }
-async function serveMcpStdio(deps) {
+async function serveMcpStdio(deps, positional) {
   const flags = deps.flags ?? {};
   const yolo = flags["yolo"] === true || flags["allow-all"] === true;
-  const whitelist = parseToolsFlag(flags);
+  const whitelist = parseToolsFlag(flags, positional);
+  if (flags["tools"] !== void 0 && whitelist === null) {
+    process.stderr.write(
+      "wrongstack MCP server: --tools requires a comma-separated tool list (e.g. `--tools read,grep` or `--tools=read,grep`)\n"
+    );
+    return 1;
+  }
   const log = (m) => process.stderr.write(`${m}
 `);
   let selectedContent;
@@ -213,7 +223,7 @@ async function serveMcpStdio(deps) {
     deps.cwd,
     deps.projectRoot,
     controller.signal,
-    deps.config.tools?.restrictToProjectRoot ?? false
+    resolveServeFsRestriction(deps.config)
   );
   const permissionPolicy = yolo ? new AllowAllPermissionPolicy() : new AutoApprovePermissionPolicy();
   const executor = new ToolExecutor(registry, {
@@ -253,7 +263,7 @@ async function serveMcpStdio(deps) {
         deps.cwd,
         deps.projectRoot,
         controller.signal,
-        deps.config.tools?.restrictToProjectRoot ?? false
+        resolveServeFsRestriction(deps.config)
       );
       const batch = await executor.executeBatch([use], requestCtx, "sequential");
       const result = batch.outputs[0]?.result;
@@ -322,7 +332,7 @@ var mcpCmd = async (args, deps) => {
   args = restoreFlags(args, deps, ["enable", "e", "transport", "url", "command"]);
   const sub = args[0];
   if (sub === "serve") {
-    return serveMcpStdio(deps);
+    return serveMcpStdio(deps, args.slice(1));
   }
   if (!sub || sub === "list") {
     const servers = deps.config.mcpServers ?? {};
@@ -429,4 +439,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-JNWEQ6T2.js.map
+//# sourceMappingURL=mcp-CMLFHRG2.js.map

package/dist/mcp-serve.d.ts

@@ -3,12 +3,42 @@ import { ToolRegistry } from '@wrongstack/core/registry';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
 import type { SubcommandDeps } from './subcommands/index.js';
+/**
+ * Resolve the `--tools` whitelist for `mcp serve`.
+ *
+ * `'tools'` is in BOOLEAN_FLAGS (a `models add` capability toggle), so
+ * parseArgs turns the space form `mcp serve --tools read,grep` into
+ * `tools: true` plus a positional CSV instead of a string value. Accept both
+ * shapes: a string value directly, or `true` + the following positional CSV.
+ * Returns null only when no list was supplied at all — callers must treat
+ * "flag present but no list" as an error, never as "no whitelist".
+ */
+export declare function parseToolsFlag(flags: Record<string, string | boolean>, positional?: readonly string[]): Set<string> | null;
 export interface SelectedMcpServeContent {
     resources: MCPServerResource[];
     prompts: MCPServerPrompt[];
 }
 /** Load only files explicitly named by trusted CLI flags; nothing is auto-discovered. */
 export declare function loadSelectedMcpServeContent(flags: Record<string, string | boolean>, cwd: string): Promise<SelectedMcpServeContent>;
+/**
+ * Whether the file tools are confined to the project root for `mcp serve`.
+ *
+ * `mcp serve` is the one surface where the file tools are driven by a REMOTE
+ * caller, so an unset config must inherit containment rather than invert it —
+ * an unset value here previously became `false`, which short-circuited
+ * `ensureInsideRoot` and let `tools/call read` return `~/.ssh/id_rsa`.
+ *
+ * This lives in one exported function rather than as a literal repeated at each
+ * call site so the invariant is testable and a third call site cannot quietly
+ * reintroduce the wrong default. Only a trusted user config can opt out:
+ * `tools.restrictToProjectRoot` is on the in-project denylist, so a
+ * checked-out repository cannot reach it.
+ */
+export declare function resolveServeFsRestriction(config: {
+    tools?: {
+        restrictToProjectRoot?: boolean | undefined;
+    } | undefined;
+}): boolean;
 /** Minimal run context — tools read cwd/projectRoot/signal; provider/session are stubs. */
 export declare function makeServeContext(cwd: string, projectRoot: string, signal: AbortSignal, restrictFsToRoot?: boolean): Context;
 /**
@@ -19,5 +49,5 @@ export declare function makeServeContext(cwd: string, projectRoot: string, signa
  * Exported for testing — the live path calls it inside `serveMcpStdio`.
  */
 export declare function selectExposedTools(registry: ToolRegistry, ctx: Context, policy: PermissionPolicy, whitelist: Set<string> | null): Promise<Tool[]>;
-export declare function serveMcpStdio(deps: SubcommandDeps): Promise<number>;
+export declare function serveMcpStdio(deps: SubcommandDeps, positional?: readonly string[]): Promise<number>;
 //# sourceMappingURL=mcp-serve.d.ts.map