actual-mcp-server 0.19.4 → 0.20.0

package/README.md

@@ -777,7 +777,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.19.4 | **Tool Count:** 77 (verified LibreChat-compatible)
+**Version:** 0.20.0 | **Tool Count:** 77 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/lib/actual-adapter/query.js

@@ -45,13 +45,44 @@ function _splitInList(valuesStr) {
 //      a double-quoted element hiding a single quote (`"x' UNION SELECT 1 --"`) is well formed by (1)
 //      yet its inner `'` would terminate upstream's wrapper. Checking the stripped value closes that.
 // A legitimate `'groceries'`, `'Smith, John'`, `"cash"`, `100` or `-5.5` passes both.
+/** A single-quoted literal whose internal quotes are SQL-ESCAPED by doubling.
+ *  `'McDonald''s'` matches; `'McDonald's'` (a lone quote) does not. */
+const SQL_ESCAPED_SINGLE_QUOTED = /^'(?:[^']|'')*'$/;
 function _isSafeInListElement(raw) {
     const t = raw.trim();
-    const wellFormed = /^'[^']*'$/.test(t) || /^"[^"]*"$/.test(t) || /^-?\d+(?:\.\d+)?$/.test(t);
+    // #433: a single-quoted element may now carry DOUBLED internal quotes. That is
+    // safe for the reason #421 made the original rule, read the other way round:
+    // upstream compiles $oneof by inlining each value verbatim as `'${String(id)}'`
+    // (aql/compiler.ts, verified against the installed source), so a LONE quote
+    // terminates that wrapper and smuggles trailing SQL, while a DOUBLED quote is
+    // exactly the escape SQL defines and produces a balanced literal.
+    if (SQL_ESCAPED_SINGLE_QUOTED.test(t))
+        return true;
+    const wellFormed = /^"[^"]*"$/.test(t) || /^-?\d+(?:\.\d+)?$/.test(t);
     if (!wellFormed)
         return false;
+    // A double-quoted element must still carry no single quote at all: upstream
+    // re-wraps it in SINGLE quotes, so an internal one would break out exactly as
+    // before. This is the #421 injection witness shape.
     return !_stripWhereQuotes(t).includes("'");
 }
+/** Coercion for IN-list elements ONLY.
+ *
+ *  Deliberately separate from `_coerceWhereValue`, which serves `=`, `!=`, `<`
+ *  and friends. Those operands travel a different compile path, and this doubling
+ *  is correct ONLY because $oneof inlines its values into SQL text verbatim. A
+ *  shared coercion would apply SQL escaping to an operand that may never reach
+ *  raw SQL, which would silently match nothing.
+ *
+ *  The doubling is PRESERVED rather than unescaped, so upstream's `'${id}'` wrap
+ *  yields `'McDonald''s'`, which SQLite reads as `McDonald's`. */
+function _coerceInListValue(s) {
+    const t = s.trim();
+    if (SQL_ESCAPED_SINGLE_QUOTED.test(t) && t.includes("''")) {
+        return t.slice(1, -1); // keep the doubling; upstream supplies the outer quotes
+    }
+    return _coerceWhereValue(s);
+}
 // Coerce a SQL value literal to a number when it looks numeric, else keep the
 // (unquoted) string. Used for IN lists and comparison operands. Empty stays a
 // string so an empty literal is not silently turned into 0.
@@ -162,10 +193,12 @@ export function parseWhereClause(query, whereClause, tableName) {
                 for (const raw of rawValues) {
                     if (!_isSafeInListElement(raw)) {
                         throw new Error(`Invalid value in IN list for column "${field}": ${JSON.stringify(raw.trim())}. ` +
-                            `Each value must be a number or a quoted string with no embedded quote.`);
+                            `Each value must be a number, a double-quoted string with no single quote, ` +
+                            `or a single-quoted string whose internal quotes are SQL-escaped by doubling ` +
+                            `(for example 'McDonald''s').`);
                     }
                 }
-                query = query.filter({ [field]: { $oneof: rawValues.map(_coerceWhereValue) } });
+                query = query.filter({ [field]: { $oneof: rawValues.map(_coerceInListValue) } });
             }
             continue;
         }

package/dist/src/lib/installed-api-version.js

@@ -53,15 +53,30 @@ export function readVersionFromTree(startDir, pkgName = PACKAGE) {
     }
     return null;
 }
-function resolveInstalledApiVersion() {
+/** Resolve any installed package's real version, or null. Same contract as the
+ *  constant below: SILENT, never throws, and null is a normal state. #445 made
+ *  this take a name so `actual_server_info` can report the resolved MCP SDK
+ *  version too without duplicating the walk. */
+export function resolveInstalledVersion(pkgName, entry = pkgName) {
     try {
         const require = createRequire(import.meta.url);
-        return readVersionFromTree(dirname(require.resolve(PACKAGE)));
+        // `entry` exists because a bare package name is NOT always resolvable. The MCP
+        // SDK exports no root path, so require.resolve('@modelcontextprotocol/sdk')
+        // throws MODULE_NOT_FOUND while '@modelcontextprotocol/sdk/server/index.js'
+        // resolves fine. That is the same class of trap as @actual-app/api not
+        // exporting its own package.json, and it matters more than it looks: with the
+        // omit-on-failure contract, an unresolvable name looks exactly like a package
+        // that is legitimately absent, so the caller passes a subpath it knows exists
+        // rather than letting the field silently disappear.
+        return readVersionFromTree(dirname(require.resolve(entry)), pkgName);
     }
     catch {
         return null;
     }
 }
+function resolveInstalledApiVersion() {
+    return resolveInstalledVersion(PACKAGE);
+}
 /** The installed version, or null when it cannot be determined. Resolved ONCE at
  *  module load. Null is a normal state, not an error: every consumer must stay
  *  silent on it rather than reporting a sentinel. */

package/dist/src/server/httpServer.js

@@ -703,16 +703,43 @@ advertisedUrl) {
             if (e2 && typeof e2.stack === 'string')
                 logger.error(e2.stack);
             if (!res.headersSent) {
-                // NOTE: this returns the raw error string to the client. That pre-existing
-                // disclosure is tracked as #446 and is deliberately out of scope here. The
-                // #438 session-init path above is CONTAINED by its own try/catch and never
-                // reaches this line, so its closed-enum contract cannot leak through here.
-                res.status(500).json({ jsonrpc: '2.0', id: payload?.id ?? null, error: { code: -32603, message: String(err) } });
+                // #446: the client gets a STABLE message plus a correlation id, never the
+                // raw error. `String(err)` here could carry a stack, raw SQL from
+                // SyncError.meta.query, an EACCES path with the OS username, or the
+                // configured upstream URL. The detail is already logged above with the
+                // request id stamped by requestContext (#221), so an operator joins the two
+                // by that id instead of reading it off the wire.
+                //
+                // The id is best effort: this catch can fire OUTSIDE requestContext.run
+                // (an error thrown while establishing the context), in which case there is
+                // nothing to correlate and the field is omitted rather than invented.
+                const requestId = requestContext.getStore()?.requestId;
+                logger.error(`[HTTP] Unhandled POST error${requestId ? ` (requestId=${requestId})` : ''}`);
+                res.status(500).json({
+                    jsonrpc: '2.0',
+                    id: payload?.id ?? null,
+                    error: {
+                        code: -32603,
+                        message: 'Internal error. The server logged the cause; quote the requestId when reporting it.',
+                        ...(requestId ? { data: { requestId } } : {}),
+                    },
+                });
             }
         }
     });
     // GET for SSE connect (reuse transport)
     app.get(httpPath, async (req, res) => {
+        // #447: the SAME gate the POST route uses. Until now this route never called
+        // it outside the OIDC branch, so in the default static-bearer posture a GET on
+        // the MCP path was unauthenticated while a POST on the identical path was not.
+        // That inconsistency is what forced #438 to withhold the session-init cause
+        // here: the cause sentences are configuration hints, and putting them on an
+        // unauthenticated route would widen what a caller without a token can learn.
+        // authenticateRequest writes its own 401 and returns false, so this is the
+        // whole change.
+        if (!authenticateRequest(req, res)) {
+            return;
+        }
         const sessionId = req.headers['mcp-session-id'];
         if (!sessionId) {
             res.status(400).json({ jsonrpc: '2.0', error: { code: -32000, message: 'No session id' }, id: null });
@@ -728,30 +755,32 @@ advertisedUrl) {
             // throw reaches the default final handler, which puts err.stack in the body
             // whenever NODE_ENV is not production (unset for a bare node run, and
             // `development` in docker-compose).
-            // #438 REVIEW: this route is deliberately NOT given the cause. Outside the
-            // OIDC branch it never calls `authenticateRequest` (POST-only, at the single
-            // call site), so anything added here is reachable without an Authorization
-            // header, and the sentences are configuration hints. The body therefore stays
-            // the constant it has always been. The POST route, which IS authenticated,
-            // carries the whole value of this feature. Reporting here can be revisited
-            // once that route's auth posture is fixed, which is #447.
-            //
-            // The peek is kept solely for the log line: it tells an operator reading the
-            // server log why this session is dead, without putting it on an unauthenticated
-            // wire. try/catch is load bearing because this route has NO error handling and
-            // the file registers no error middleware, so under Express 5 a throw reaches the
-            // default final handler, which emits err.stack whenever NODE_ENV is not
-            // production (unset for a bare node run, `development` in docker-compose).
+            // #438 + #447: the cause IS reported here now. It was withheld while this
+            // route was unauthenticated in the default static-bearer posture, because
+            // the cause sentences are configuration hints. #447 gated the route with the
+            // same authenticateRequest the POST route uses, so the reason for withholding
+            // is gone. Same closed enum, same fixed sentences, this route's own status
+            // and code. try/catch is still load bearing: this route has no error handling
+            // of its own and the file registers no error middleware, so under Express 5 a
+            // throw reaches the default final handler, which emits err.stack whenever
+            // NODE_ENV is not production.
+            let knownFailure;
             try {
-                const knownFailure = peekInitFailure(sessionId);
-                if (knownFailure) {
-                    logger.warn(`[SESSION] GET on session ${sessionId} whose init failed (${knownFailure.cause}); returning the generic body (auth posture, see the note above)`);
-                }
+                knownFailure = peekInitFailure(sessionId);
             }
             catch {
-                // never let diagnostics break the response
+                knownFailure = undefined;
+            }
+            if (knownFailure) {
+                logger.warn(`[SESSION] GET on session ${sessionId} whose init failed (${knownFailure.cause}); reporting the cause`);
             }
-            res.status(400).json({ jsonrpc: '2.0', error: { code: -32000, message: 'Transport not ready' }, id: null });
+            res.status(400).json({
+                jsonrpc: '2.0',
+                error: knownFailure
+                    ? { code: -32000, message: knownFailure.sentence, data: { cause: knownFailure.cause, sessionInitFailed: true } }
+                    : { code: -32000, message: 'Transport not ready' },
+                id: null,
+            });
             return;
         }
         await transport.handleRequest(req, res);

package/dist/src/tools/server_info.js

@@ -3,6 +3,11 @@ import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import actualToolsManager from '../actualToolsManager.js';
+import { INSTALLED_API_VERSION, resolveInstalledVersion } from '../lib/installed-api-version.js';
+/** Resolved once at module load, not per call: the walk does blocking file reads
+ *  and this tool can be called in a loop. The SDK exports no root path, so the
+ *  resolvable subpath is passed explicitly (#445). */
+const MCP_SDK_RESOLVED = resolveInstalledVersion('@modelcontextprotocol/sdk', '@modelcontextprotocol/sdk/server/index.js');
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Read version from environment variable (set during Docker build) or package.json
@@ -65,9 +70,21 @@ Use this to check server status, verify version compatibility, or debug issues.`
                 platform: process.platform,
                 arch: process.arch,
             },
+            // #445: report BOTH the declared range and what is actually installed. They
+            // answer different questions ("what does this build allow" versus "what is it
+            // running"), and #427 needed the second: a caret range reports identically for
+            // every version inside it, which is exactly the ambiguity that made a server
+            // and api version skew hard to diagnose.
+            //
+            // The resolved fields are OMITTED when they cannot be determined, never set to
+            // a sentinel: absence means "could not resolve" and no consumer has to
+            // special-case a magic string. The declared fields keep their existing
+            // behaviour and value, so nothing that reads them today breaks.
             dependencies: {
                 mcpSdk: packageInfo.dependencies?.['@modelcontextprotocol/sdk'] ?? 'unknown',
                 actualApi: packageInfo.dependencies?.['@actual-app/api'] ?? 'unknown',
+                ...(MCP_SDK_RESOLVED ? { mcpSdkResolved: MCP_SDK_RESOLVED } : {}),
+                ...(INSTALLED_API_VERSION ? { actualApiResolved: INSTALLED_API_VERSION } : {}),
             },
             status: {
                 uptime: uptimeFormatted,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.19.4",
+  "version": "0.20.0",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -78,7 +78,7 @@
     "mcp-auth": "^0.2.0",
     "winston": "^3.18.3",
     "winston-daily-rotate-file": "^5.0.0",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "optionalDependencies": {
     "prom-client": "*"
@@ -86,8 +86,8 @@
   "devDependencies": {
     "@playwright/test": "^1.60.0",
     "@types/express": "^5.0.3",
-    "@types/node": "^26.1.0",
-    "knip": "^6.32.0",
+    "@types/node": "^26.4.1",
+    "knip": "^6.34.0",
     "node-fetch": "^3.3.2",
     "tsconfig-paths": "^4.2.0",
     "typescript": "^7.0.2"