actual-mcp-server 0.19.1 → 0.19.3

package/README.md

@@ -778,7 +778,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.19.1 | **Tool Count:** 77 (verified LibreChat-compatible)
+**Version:** 0.19.3 | **Tool Count:** 77 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/lib/actual-adapter/query.js

@@ -8,6 +8,50 @@ import { getFieldType } from '../actual-schema.js';
 function _stripWhereQuotes(s) {
     return s.trim().replace(/^['"]|['"]$/g, '');
 }
+// #421: split an IN-list body on commas that are OUTSIDE quoted literals, so a legitimate value
+// containing a comma (e.g. 'Smith, John') stays ONE element. A naive split(',') both broke such
+// values and, with the element check below, turned them into a confusing rejection.
+function _splitInList(valuesStr) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    for (const ch of valuesStr) {
+        if (quote) {
+            cur += ch;
+            if (ch === quote)
+                quote = null;
+        }
+        else if (ch === "'" || ch === '"') {
+            quote = ch;
+            cur += ch;
+        }
+        else if (ch === ',') {
+            out.push(cur);
+            cur = '';
+        }
+        else {
+            cur += ch;
+        }
+    }
+    out.push(cur);
+    return out;
+}
+// #421: whether an IN-list element is safe to feed into upstream's `$oneof`, which stringifies each
+// element as `'${id}'` with NO escaping. Two conditions, and both matter:
+//   1. It must be WELL FORMED: a number, or a single-/double-quoted string with no embedded quote of
+//      the same kind, so a crafted element like `'b') UNION SELECT 1 --'` (unbalanced) is rejected.
+//   2. The value that ACTUALLY REACHES `$oneof` must contain no single quote. `_stripWhereQuotes`
+//      removes the outer pair of EITHER quote kind and upstream always re-wraps in SINGLE quotes, so
+//      a double-quoted element hiding a single quote (`"x' UNION SELECT 1 --"`) is well formed by (1)
+//      yet its inner `'` would terminate upstream's wrapper. Checking the stripped value closes that.
+// A legitimate `'groceries'`, `'Smith, John'`, `"cash"`, `100` or `-5.5` passes both.
+function _isSafeInListElement(raw) {
+    const t = raw.trim();
+    const wellFormed = /^'[^']*'$/.test(t) || /^"[^"]*"$/.test(t) || /^-?\d+(?:\.\d+)?$/.test(t);
+    if (!wellFormed)
+        return false;
+    return !_stripWhereQuotes(t).includes("'");
+}
 // Coerce a SQL value literal to a number when it looks numeric, else keep the
 // (unquoted) string. Used for IN lists and comparison operands. Empty stays a
 // string so an empty literal is not silently turned into 0.
@@ -100,7 +144,7 @@ export function parseWhereClause(query, whereClause, tableName) {
         const inMatch = trimmedCondition.match(/^([\w.]+)\s+IN\s+\((.+)\)$/i);
         if (inMatch) {
             const [, field, valuesStr] = inMatch;
-            const rawValues = valuesStr.split(',');
+            const rawValues = _splitInList(valuesStr);
             if (_isBooleanField(tableName, field)) {
                 // #420: `$oneof` STRINGIFIES every element (upstream `compiler.ts` emits
                 // `'${String(id)}'`), so `is_parent IN (true, false)` would compile to
@@ -112,6 +156,15 @@ export function parseWhereClause(query, whereClause, tableName) {
                 query = query.filter({ $or: orConditions });
             }
             else {
+                // #421: every element must be safe before it reaches upstream's unescaped `$oneof`. Reject a
+                // value that could terminate its own quote (single- OR double-quote wrapped) and smuggle
+                // trailing SQL.
+                for (const raw of rawValues) {
+                    if (!_isSafeInListElement(raw)) {
+                        throw new Error(`Invalid value in IN list for column "${field}": ${JSON.stringify(raw.trim())}. ` +
+                            `Each value must be a number or a quoted string with no embedded quote.`);
+                    }
+                }
                 query = query.filter({ [field]: { $oneof: rawValues.map(_coerceWhereValue) } });
             }
             continue;

package/dist/src/lib/financial-analysis.js

@@ -258,6 +258,13 @@ export function summarizeAccountFlow(snapshot, input) {
         const counterpart = transaction.transfer_id ? maps.transactions.get(transaction.transfer_id) : undefined;
         const payee = transaction.payee ? maps.payees.get(transaction.payee) : undefined;
         const counterpartAccountId = counterpart?.account ?? payee?.transfer_acct ?? null;
+        // #428: when the counterpart cannot be resolved (no counterpart row and no payee transfer_acct),
+        // counterpartSelected is false and the leg is bucketed by SIGN into intoSelection / outOfSelection.
+        // This is the deterministic rule: within-selection membership requires POSITIVE proof both legs are
+        // selected, which an unresolvable counterpart cannot give. The outcome is not silent: the
+        // transfersByAccount row below carries matchedCounterpart=false, so a caller can see the leg was
+        // classified without a resolved counterparty. netTransferEffect (line above) already counted the
+        // amount, so reconciliation stays exact regardless of the bucket.
         const counterpartSelected = counterpartAccountId ? selected.has(counterpartAccountId) : false;
         if (counterpartSelected) {
             withinSelectionTimingEffect += amount;
@@ -290,14 +297,25 @@ export function summarizeAccountFlow(snapshot, input) {
             });
         }
     }
-    // The tool handler always supplies balances (via balanceAccountIds), so difference is exact here.
-    // If a future caller omits them, both reduce to 0 and difference reads as a false "exact": #428.
-    const openingBalance = uniqueAccountIds.reduce((sum, id) => sum + integer(snapshot.openingBalances?.[id] ?? 0, `Opening balance for ${id}`), 0);
-    const closingBalance = uniqueAccountIds.reduce((sum, id) => sum + integer(snapshot.closingBalances?.[id] ?? 0, `Closing balance for ${id}`), 0);
-    const balanceChange = closingBalance - openingBalance;
+    // #428: balances are OPTIONAL on the snapshot. The tool handler always supplies them (via
+    // balanceAccountIds), so on the tool path this is true and reconciliation is exact by construction.
+    // A caller that omits either map, though, would otherwise reduce both to 0 and read difference as a
+    // false "exact" zero. The check is on the MAP being undefined (entirely unpopulated), NOT a per-id
+    // lookup: the `?? 0` per-id default is legitimate for a genuine zero-balance account.
+    const balancesAvailable = snapshot.openingBalances !== undefined && snapshot.closingBalances !== undefined;
+    const openingBalance = balancesAvailable
+        ? uniqueAccountIds.reduce((sum, id) => sum + integer(snapshot.openingBalances?.[id] ?? 0, `Opening balance for ${id}`), 0)
+        : null;
+    const closingBalance = balancesAvailable
+        ? uniqueAccountIds.reduce((sum, id) => sum + integer(snapshot.closingBalances?.[id] ?? 0, `Closing balance for ${id}`), 0)
+        : null;
+    const balanceChange = openingBalance !== null && closingBalance !== null ? closingBalance - openingBalance : null;
     const netExternalCashFlow = income - incomeReversals + credits + uncategorizedInflows - expenseOutflow;
     const totalAdjustments = startingBalance;
     const calculatedBalanceChange = netExternalCashFlow + netTransferEffect + totalAdjustments;
+    // When balances are unavailable, difference must NOT read as a reconciled value. Null it so a
+    // caller cannot mistake an unpopulated run for a reconciled one.
+    const difference = balanceChange !== null ? balanceChange - calculatedBalanceChange : null;
     return {
         dateRange: { startDate: input.startDate, endDate: input.endDate },
         accounts: uniqueAccountIds.map(id => ({ id, name: maps.accounts.get(id)?.name ?? id })),
@@ -322,9 +340,12 @@ export function summarizeAccountFlow(snapshot, input) {
         transfersByAccount: transfersByAccount.sort((a, b) => `${a.date}:${a.fromAccountId}:${a.toAccountId}`.localeCompare(`${b.date}:${b.fromAccountId}:${b.toAccountId}`)),
         adjustments: { startingBalance, total: totalAdjustments },
         reconciliation: {
+            // #428: balancesAvailable is false when the snapshot omitted the balance maps; difference and
+            // actualBalanceChange are then null so an unpopulated run cannot read as a reconciled one.
+            balancesAvailable,
             calculatedBalanceChange,
             actualBalanceChange: balanceChange,
-            difference: balanceChange - calculatedBalanceChange,
+            difference,
         },
     };
 }

package/dist/src/lib/query-validator.js

@@ -67,17 +67,29 @@ function extractWhereFields(sql) {
     if (!whereMatch)
         return fields;
     const whereClause = whereMatch[1];
-    // Find field references (table.field or field)
-    const fieldMatches = whereClause.matchAll(/(\w+)\.(\w+)|(?:^|\s)(\w+)\s*[=<>!]/g);
+    // Find field references (table.field or field).
+    // #421: a bare column must be extracted (and therefore schema-validated) not only before a
+    // comparison operator, but also before IN / LIKE / IS / BETWEEN (with their NOT forms). Before
+    // this, `bogus_col IN ('a')`, `bogus_col LIKE '%a%'` and `bogus_col IS NULL` extracted no field
+    // and so skipped the allowlist check entirely, while `bogus_col = 'a'` was correctly rejected.
+    const fieldMatches = whereClause.matchAll(/(\w+)\.(\w+)|(?:^|\s)(\w+)\s*[=<>!]|(?:^|\s)(\w+)\s+(?:NOT\s+)?(?:IN|LIKE|BETWEEN)\b|(?:^|\s)(\w+)\s+IS\b/gi);
     for (const match of fieldMatches) {
         if (match[1] && match[2]) {
             // table.field
             fields.push({ table: match[1], field: match[2] });
         }
         else if (match[3]) {
-            // simple field
+            // simple field before a comparison operator
             fields.push({ field: match[3] });
         }
+        else if (match[4]) {
+            // simple field before IN / LIKE / BETWEEN (optionally negated)
+            fields.push({ field: match[4] });
+        }
+        else if (match[5]) {
+            // simple field before IS (NULL / NOT NULL)
+            fields.push({ field: match[5] });
+        }
     }
     return fields;
 }
@@ -243,6 +255,21 @@ export function validateQueryShape(query) {
     if (/;\s*\S/.test(stripped)) {
         throw new Error('actual_query_run does not allow stacked statements (multiple statements separated by ";").');
     }
+    // #421: SQL comments. Checked on the literal-blanked `stripped`, so a `--` or `/*` INSIDE a
+    // string literal is already gone and cannot false-trigger. A comment left in the query is a
+    // trailing-SQL smuggling vector (it comments out the tombstone filter this server relies on),
+    // and a read tool has no legitimate use for one, so it is rejected outright.
+    if (/--/.test(stripped) || /\/\*/.test(stripped)) {
+        throw new Error('actual_query_run does not allow SQL comments ("--" or "/* */").');
+    }
+    // #421: compound-query set operators. parseWhereClause translates a SINGLE WHERE clause, so a
+    // UNION/EXCEPT/INTERSECT can never be handled correctly, and left unrejected it lets a crafted
+    // IN-list value append a second SELECT past the validated clause. Rejected on the blanked string
+    // so the word inside a literal (e.g. notes = 'union dues') stays allowed.
+    const COMPOUND = /\b(UNION|EXCEPT|INTERSECT)\b/i;
+    if (COMPOUND.test(stripped)) {
+        throw new Error('actual_query_run does not allow compound queries (UNION, EXCEPT, INTERSECT).');
+    }
     // Data- and schema-modification keywords.
     const FORBIDDEN = /\b(INSERT|UPDATE|DELETE|DROP|ALTER|ATTACH|DETACH|PRAGMA|CREATE|REPLACE|EXEC|EXECUTE|VACUUM|TRUNCATE|GRANT|REVOKE|MERGE|INTO)\b/i;
     if (FORBIDDEN.test(stripped)) {

package/dist/src/tools/account_flow_summary.js

@@ -24,7 +24,7 @@ export default createTool({
         'Explain the exact balance change across a selected set of accounts over an inclusive date range, in integer cents.',
         'Separates external income, expense outflow, credits, uncategorized inflows, starting-balance adjustments, and transfers into, out of, or within the selection.',
         'Transfers are detected from transfer_id and are never spending or income.',
-        'openingBalance is immediately before startDate and closingBalance is at the end of the inclusive endDate; reconciliation.difference is exact and transfersByAccount names the funding counterparties.',
+        'openingBalance is immediately before startDate and closingBalance is at the end of the inclusive endDate; reconciliation.difference is exact (reconciliation.balancesAvailable is true) and transfersByAccount names the funding counterparties.',
         'Amounts are in cents: $100.00 = 10000. Dates are YYYY-MM-DD.',
     ].join(' '),
     schema: InputSchema,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"