@yawlabs/caddy-mcp 1.0.0 → 1.0.1

package/dist/index.js

@@ -41,6 +41,16 @@ function getHeaders(contentType) {
 function normalizePath(path) {
   return path.replace(/^\/?(config(\/|$))?/, "");
 }
+function rejectTraversal(path) {
+  if (/(^|\/)\.\.(\/|$)/.test(path)) {
+    return {
+      ok: false,
+      status: 0,
+      error: `Invalid path "${path}": '..' segments are not allowed`
+    };
+  }
+  return null;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -129,22 +139,32 @@ async function attemptRequest(method, path, body, contentType, timeout) {
 }
 function configGet(path = "") {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("GET", `/config/${normalized}`);
 }
 function configPost(path, value) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("POST", `/config/${normalized}`, value);
 }
 function configPut(path, value) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("PUT", `/config/${normalized}`, value);
 }
 function configPatch(path, value) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("PATCH", `/config/${normalized}`, value);
 }
 function configDelete(path) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("DELETE", `/config/${normalized}`);
 }
 var LOAD_TIMEOUT = 6e4;
@@ -169,14 +189,20 @@ function getPkiCertificates(ca = "local") {
   return caddyRequest("GET", `/pki/ca/${ca}/certificates`);
 }
 function configByIdGet(id, subpath = "") {
+  const bad = rejectTraversal(subpath);
+  if (bad) return Promise.resolve(bad);
   const path = subpath ? `/id/${id}/${subpath}` : `/id/${id}`;
   return caddyRequest("GET", path);
 }
 function configByIdSet(id, value, method = "PATCH", subpath = "") {
+  const bad = rejectTraversal(subpath);
+  if (bad) return Promise.resolve(bad);
   const path = subpath ? `/id/${id}/${subpath}` : `/id/${id}`;
   return caddyRequest(method, path, value);
 }
 function configByIdDelete(id, subpath = "") {
+  const bad = rejectTraversal(subpath);
+  if (bad) return Promise.resolve(bad);
   const path = subpath ? `/id/${id}/${subpath}` : `/id/${id}`;
   return caddyRequest("DELETE", path);
 }
@@ -399,6 +425,12 @@ ${lines.join("\n")}` }] };
       if (action === "save") {
         const current2 = await configGet();
         if (!current2.ok) return formatResult(current2);
+        if (current2.data === void 0) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: "Error: no config loaded to snapshot" }]
+          };
+        }
         saveSnapshot(current2.data, "manual");
         return { content: [{ type: "text", text: "Snapshot saved." }] };
       }
@@ -809,7 +841,7 @@ function registerRouteTools(server) {
   );
   server.tool(
     "caddy_remove_route",
-    "Remove a route. Target by @id (preferred \u2014 stable across reorderings) or by array index on a specific server. Uses ETags to prevent concurrent overwrites.",
+    "Remove a route. Target by @id (preferred \u2014 stable across reorderings) or by array index on a specific server. Index-based removal is a two-step read-then-delete and can race against concurrent edits; prefer @id when possible.",
     {
       id: z4.string().regex(/^[\w-]{1,128}$/).optional().describe("The @id of the route to remove (preferred \u2014 stable even if routes get reordered)"),
       index: z4.number().int().nonnegative().optional().describe("Zero-based index of the route in the server's routes array (only used if id is not provided)"),

package/dist/server.js

@@ -39,6 +39,16 @@ function getHeaders(contentType) {
 function normalizePath(path) {
   return path.replace(/^\/?(config(\/|$))?/, "");
 }
+function rejectTraversal(path) {
+  if (/(^|\/)\.\.(\/|$)/.test(path)) {
+    return {
+      ok: false,
+      status: 0,
+      error: `Invalid path "${path}": '..' segments are not allowed`
+    };
+  }
+  return null;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -127,22 +137,32 @@ async function attemptRequest(method, path, body, contentType, timeout) {
 }
 function configGet(path = "") {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("GET", `/config/${normalized}`);
 }
 function configPost(path, value) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("POST", `/config/${normalized}`, value);
 }
 function configPut(path, value) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("PUT", `/config/${normalized}`, value);
 }
 function configPatch(path, value) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("PATCH", `/config/${normalized}`, value);
 }
 function configDelete(path) {
   const normalized = normalizePath(path);
+  const bad = rejectTraversal(normalized);
+  if (bad) return Promise.resolve(bad);
   return caddyRequest("DELETE", `/config/${normalized}`);
 }
 var LOAD_TIMEOUT = 6e4;
@@ -167,14 +187,20 @@ function getPkiCertificates(ca = "local") {
   return caddyRequest("GET", `/pki/ca/${ca}/certificates`);
 }
 function configByIdGet(id, subpath = "") {
+  const bad = rejectTraversal(subpath);
+  if (bad) return Promise.resolve(bad);
   const path = subpath ? `/id/${id}/${subpath}` : `/id/${id}`;
   return caddyRequest("GET", path);
 }
 function configByIdSet(id, value, method = "PATCH", subpath = "") {
+  const bad = rejectTraversal(subpath);
+  if (bad) return Promise.resolve(bad);
   const path = subpath ? `/id/${id}/${subpath}` : `/id/${id}`;
   return caddyRequest(method, path, value);
 }
 function configByIdDelete(id, subpath = "") {
+  const bad = rejectTraversal(subpath);
+  if (bad) return Promise.resolve(bad);
   const path = subpath ? `/id/${id}/${subpath}` : `/id/${id}`;
   return caddyRequest("DELETE", path);
 }
@@ -397,6 +423,12 @@ ${lines.join("\n")}` }] };
       if (action === "save") {
         const current2 = await configGet();
         if (!current2.ok) return formatResult(current2);
+        if (current2.data === void 0) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: "Error: no config loaded to snapshot" }]
+          };
+        }
         saveSnapshot(current2.data, "manual");
         return { content: [{ type: "text", text: "Snapshot saved." }] };
       }
@@ -807,7 +839,7 @@ function registerRouteTools(server) {
   );
   server.tool(
     "caddy_remove_route",
-    "Remove a route. Target by @id (preferred \u2014 stable across reorderings) or by array index on a specific server. Uses ETags to prevent concurrent overwrites.",
+    "Remove a route. Target by @id (preferred \u2014 stable across reorderings) or by array index on a specific server. Index-based removal is a two-step read-then-delete and can race against concurrent edits; prefer @id when possible.",
     {
       id: z4.string().regex(/^[\w-]{1,128}$/).optional().describe("The @id of the route to remove (preferred \u2014 stable even if routes get reordered)"),
       index: z4.number().int().nonnegative().optional().describe("Zero-based index of the route in the server's routes array (only used if id is not provided)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/caddy-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "MCP server for managing Caddy web servers via the admin API",
   "license": "MIT",
   "author": "Yaw Labs <contact@yaw.sh> (https://yaw.sh)",