apple-numbers-mcp 1.1.19 → 1.2.0

package/README.md

@@ -675,6 +675,7 @@ All configuration is optional — the server works out of the box.
 | `APPLE_NUMBERS_MCP_MAX_BUFFER` | 50 MB (Python reader) / 64 MB (AppleScript) | Max bytes captured from a subprocess's stdout, applied to both the Python reader and the AppleScript layer. Raise it if a very large spreadsheet is truncated; lower it to cap memory. |
 | `APPLE_NUMBERS_MCP_CONFIG_FILE` | `~/Library/Application Support/apple-numbers-mcp/config.json` | Path to the JSON config file (see below). |
 | `APPLE_NUMBERS_MCP_NO_AUTO_SETUP` | unset (auto-setup on) | Set to a truthy value (`1`, `true`) to disable the one-time automatic creation of the Python venv. When set, the server will not run `setup.sh` on its own — you must provide `numbers-parser` yourself (`pip3 install numbers-parser` or `pnpm run setup`). |
+| `APPLE_NUMBERS_MCP_EXTRA_ROOTS` | unset | Colon-separated **absolute** directories to add to the allowed-path roots, e.g. `/Data/Finance:/srv/shared`. The built-in roots already cover your home directory, the temp dirs and `/Volumes` (where external and network mounts appear), so this is for genuinely unusual layouts rather than routine configuration. Entries are canonicalized like the built-ins, so a symlinked entry cannot smuggle in a wider parent; relative and empty entries are ignored. **Widening a security boundary — set it deliberately.** |
 | `APPLE_NUMBERS_MCP_SETUP_TIMEOUT` | `300000` (5 minutes) | Timeout in milliseconds for the automatic venv bootstrap (`setup.sh`). Raise it on a slow network where the `numbers-parser` pip install would otherwise time out. |
 
 > **Per-call timeouts are not configurable.** Every `numbers-parser` sidecar call
@@ -775,9 +776,10 @@ These are tracked for future releases. The underlying `numbers-parser` library h
 - Ensure the file extension is `.numbers`.
 
 ### "Output path … is outside the allowed roots" / "Input path … is outside the allowed roots"
-- `export-table`, `create-spreadsheet` and `import-csv` read and write ordinary files, so their paths are restricted to your **home directory**, `/tmp`, `/private/tmp`, and `/Volumes` — the server will not write into `/etc`, `/Library`, an app bundle, or any other system location, and will not read a source file from one.
+- Every tool that touches a file on disk is bounded to your **home directory**, `/tmp`, `/private/tmp`, and `/Volumes` — the server will not write into `/etc`, `/Library`, an app bundle, or any other system location, and will not read from one.
+- **As of 1.2.0 this covers the `.numbers` file itself**, not just export/import destinations. `get-file-info`, `read-table`, `search` and the in-place writes (`set-cell`, `add-rows`, `set-formula`, …) previously accepted a path anywhere on disk.
 - Symlinks are resolved **before** the check, so a link inside an allowed directory that points outside it is rejected too; the error reports the resolved path, which is usually the quickest way to see where a path really went.
-- Fix: choose a path under one of those roots (`~/Documents/report.csv`, `/tmp/report.csv`). There is no override setting.
+- Fix: choose a path under one of those roots (`~/Documents/report.numbers`, `/tmp/report.csv`). If your spreadsheets genuinely live somewhere else, add that directory to `APPLE_NUMBERS_MCP_EXTRA_ROOTS` — see [Environment variables](#environment-variables).
 
 ### Formatting / formula tools fail with "Numbers.app not running" or "Not authorized to send Apple events to Numbers"
 - Open Numbers.app at least once. macOS will prompt for automation permission — accept it.

package/build/index.js

@@ -21813,8 +21813,7 @@ function unmergeCells(filePath, sheet, table, startRow, startCol, endRow, endCol
 
 // src/services/numbersManager.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { resolve as resolve2, extname } from "node:path";
-import { homedir as homedir2 } from "node:os";
+import { extname } from "node:path";
 
 // src/utils/exportPath.ts
 import { lstatSync, readlinkSync, realpathSync } from "node:fs";
@@ -21833,12 +21832,18 @@ var ALLOWED_EXPORT_ROOTS = [
   "/Volumes"
 ];
 var ALLOWED_EXPORT_ROOTS_TEXT = "your home directory, /tmp, /private/tmp, or /Volumes";
+var EXTRA_ROOTS_ENV = "APPLE_NUMBERS_MCP_EXTRA_ROOTS";
+function extraRoots() {
+  const raw = process.env[EXTRA_ROOTS_ENV];
+  if (!raw) return [];
+  return raw.split(":").map((s) => s.trim()).filter((s) => s.length > 0 && isAbsolute(s));
+}
 function canonicalize(path) {
   return realpathSync.native(path);
 }
 function allowedRoots() {
   const roots = [];
-  for (const root of ALLOWED_EXPORT_ROOTS) {
+  for (const root of [...ALLOWED_EXPORT_ROOTS, ...extraRoots()]) {
     if (!roots.includes(root)) roots.push(root);
     try {
       const canonical = canonicalize(root);
@@ -21912,9 +21917,32 @@ function resolveWithinAllowedRoots(path, label) {
 
 // src/services/numbersManager.ts
 var NumbersManager = class {
+  /**
+   * Resolve and validate the path of an EXISTING `.numbers` file.
+   *
+   * This is the resolver behind `get-file-info`, `read-table`, `search` and
+   * every in-place write (`set-cell`, `add-rows`, `set-formula`, …). It used to
+   * expand `~`, `resolve()` and check the extension — and nothing else — so
+   * those tools could read and modify a `.numbers` file **anywhere on disk**,
+   * while its sibling `validateOutputPath` had enforced the allowed-roots
+   * boundary since 1.1.19. That asymmetry was the largest remaining gap here.
+   *
+   * It now goes through the same `resolveWithinAllowedRoots` as the write side,
+   * which also brings the hardening that came with it: canonicalization via
+   * `realpathSync.native` (so a case-respelled segment cannot defeat the check
+   * on case-insensitive APFS) and symlink resolution BEFORE the comparison (so
+   * a link inside an allowed directory cannot point out of it).
+   *
+   * The extension is checked on the CANONICAL path for the same reason it is on
+   * the output side: a symlink must not be able to present a `.numbers` name
+   * for a target that is something else entirely.
+   *
+   * The built-in roots cover home, the temp dirs and `/Volumes`, so a file the
+   * user could plausibly want to open is almost always already inside them.
+   * `APPLE_NUMBERS_MCP_EXTRA_ROOTS` exists for the layouts they are not.
+   */
   validatePath(filePath) {
-    const expanded = filePath.startsWith("~") ? filePath.replace(/^~/, homedir2()) : filePath;
-    const resolved = resolve2(expanded);
+    const resolved = resolveWithinAllowedRoots(filePath, "Input path");
     if (!existsSync3(resolved)) {
       throw new Error(`File not found: ${resolved}`);
     }
@@ -22444,11 +22472,11 @@ First use get-file-info and read-table to read the relevant table(s) so you know
 // src/services/fileConfig.ts
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
 import { join as join3 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir2 } from "node:os";
 function fileConfigPath(env = process.env) {
   const override = env.APPLE_NUMBERS_MCP_CONFIG_FILE;
   if (override && override.trim()) return override.trim();
-  return join3(homedir3(), "Library", "Application Support", "apple-numbers-mcp", "config.json");
+  return join3(homedir2(), "Library", "Application Support", "apple-numbers-mcp", "config.json");
 }
 function loadFileConfig(env = process.env, path = fileConfigPath(env)) {
   const applied = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-numbers-mcp",
-  "version": "1.1.19",
+  "version": "1.2.0",
   "description": "MCP server for Apple Numbers - read, write, search, and format .numbers spreadsheets via Claude and other AI assistants",
   "type": "module",
   "main": "build/index.js",