@yasserkhanorg/e2e-agents 0.9.0 → 0.11.0

package/dist/esm/mcp-server.js

@@ -5,7 +5,7 @@
  * Exposes tools for Claude and Playwright agents to discover, generate, and heal tests
  */
 import { spawnSync } from 'child_process';
-import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, realpathSync } from 'fs';
 import { resolve } from 'path';
 import { globSync } from 'glob';
 /**
@@ -285,6 +285,23 @@ export class E2EAgentsMCPServer {
             if (!validatePathIsWithinRoot(filePath, this.repoRoot)) {
                 return JSON.stringify({ error: 'Access denied' });
             }
+            // SECURITY: Symlink resolution — resolve the real path to prevent symlink escape.
+            // Only check if the parent directory exists (file itself may not exist yet).
+            const parentDir = resolve(filePath, '..');
+            if (existsSync(parentDir)) {
+                const realParent = realpathSync(parentDir);
+                if (!validatePathIsWithinRoot(realParent, this.repoRoot)) {
+                    return JSON.stringify({ error: 'Access denied' });
+                }
+            }
+            // SECURITY: Restrict writes to test-related paths only.
+            // Allowed: specs/, .e2e-ai-agents/, and files matching *.spec.ts / *.test.ts
+            const relPath = args.path.replace(/\\/g, '/');
+            const isTestSpec = /\.(spec|test)\.(ts|js|tsx|jsx)$/.test(relPath);
+            const isAllowedDir = relPath.startsWith('specs/') || relPath.startsWith('.e2e-ai-agents/');
+            if (!isTestSpec && !isAllowedDir) {
+                return JSON.stringify({ error: 'Access denied: writes restricted to test specs and .e2e-ai-agents/' });
+            }
             // SECURITY: Size limit to prevent resource exhaustion
             if (args.content.length > 10 * 1024 * 1024) {
                 // 10MB limit

package/dist/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAaA,UAAU,IAAI;IACV,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AA4GD;;;GAGG;AACH,qBAAa,kBAAkB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,WAAW,CAAc;gBAErB,QAAQ,GAAE,MAAsB;IAM5C,OAAO,CAAC,WAAW;IAmGnB;;;OAGG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAwB5E,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,SAAS;IAqBjB,OAAO,CAAC,QAAQ;IAyDhB,OAAO,CAAC,aAAa;IA2BrB,OAAO,CAAC,oBAAoB;IAqD5B,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,sBAAsB;IAW9B;;OAEG;IACH,QAAQ,IAAI,IAAI,EAAE;CAGrB;AAYD,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAaA,UAAU,IAAI;IACV,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AA4GD;;;GAGG;AACH,qBAAa,kBAAkB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,WAAW,CAAc;gBAErB,QAAQ,GAAE,MAAsB;IAM5C,OAAO,CAAC,WAAW;IAmGnB;;;OAGG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAwB5E,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,SAAS;IAwCjB,OAAO,CAAC,QAAQ;IAyDhB,OAAO,CAAC,aAAa;IA2BrB,OAAO,CAAC,oBAAoB;IAqD5B,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,sBAAsB;IAW9B;;OAEG;IACH,QAAQ,IAAI,IAAI,EAAE;CAGrB;AAYD,eAAe,kBAAkB,CAAC"}

package/dist/mcp-server.js

@@ -288,6 +288,23 @@ class E2EAgentsMCPServer {
             if (!validatePathIsWithinRoot(filePath, this.repoRoot)) {
                 return JSON.stringify({ error: 'Access denied' });
             }
+            // SECURITY: Symlink resolution — resolve the real path to prevent symlink escape.
+            // Only check if the parent directory exists (file itself may not exist yet).
+            const parentDir = (0, path_1.resolve)(filePath, '..');
+            if ((0, fs_1.existsSync)(parentDir)) {
+                const realParent = (0, fs_1.realpathSync)(parentDir);
+                if (!validatePathIsWithinRoot(realParent, this.repoRoot)) {
+                    return JSON.stringify({ error: 'Access denied' });
+                }
+            }
+            // SECURITY: Restrict writes to test-related paths only.
+            // Allowed: specs/, .e2e-ai-agents/, and files matching *.spec.ts / *.test.ts
+            const relPath = args.path.replace(/\\/g, '/');
+            const isTestSpec = /\.(spec|test)\.(ts|js|tsx|jsx)$/.test(relPath);
+            const isAllowedDir = relPath.startsWith('specs/') || relPath.startsWith('.e2e-ai-agents/');
+            if (!isTestSpec && !isAllowedDir) {
+                return JSON.stringify({ error: 'Access denied: writes restricted to test specs and .e2e-ai-agents/' });
+            }
             // SECURITY: Size limit to prevent resource exhaustion
             if (args.content.length > 10 * 1024 * 1024) {
                 // 10MB limit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yasserkhanorg/e2e-agents",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Pluggable LLM provider library for AI-powered test automation. Use Claude, Ollama, or your own LLM. Integrate with Playwright, Jest, or any test framework. MCP server for test agents, cost tracking, and hybrid provider mode.",
   "main": "dist/index.js",
   "module": "dist/esm/index.js",
@@ -53,12 +53,10 @@
     "@anthropic-ai/sdk": "^0.73.0",
     "glob": "^11.0.0",
     "marked": "^15.0.6",
-    "openai": "^4.73.0",
-    "pdf-parse": "^1.1.1"
+    "openai": "^4.73.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "@types/pdf-parse": "^1.1.4",
     "typescript": "^5.6.0"
   },
   "repository": {