d365fo-mcp 1.0.0

package/dist/utils/packageResolver.js

@@ -0,0 +1,174 @@
+/**
+ * Package Resolver
+ * Maps model names to package names using descriptor XML files
+ * and filesystem scanning.
+ *
+ * In D365FO, the metadata directory structure is:
+ *   {Root}/{PackageName}/{ModelName}/AxClass/...
+ *   {Root}/{PackageName}/Descriptor/{ModelName}.xml
+ *
+ * The descriptor XML contains <ModelModule> (package name) and <Name> (model name).
+ * A single package (e.g., "CustomExtensions") can contain many models
+ * (e.g., "Contoso Utilities", "Contoso Reporting").
+ *
+ * This resolver builds a map from model name -> package info by:
+ * 1. Reading descriptor XML files (primary strategy)
+ * 2. Falling back to filesystem scanning for directories with AOT-type folders
+ */
+import * as fs from 'fs/promises';
+import { realpathSync } from 'fs';
+import * as path from 'path';
+/**
+ * Resolve the actual on-disk casing of a path (Windows is case-insensitive but
+ * VS Code and Copilot compare paths case-sensitively). Falls back to the
+ * original string if the path does not exist yet.
+ */
+function normalizePathCase(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+export class PackageResolver {
+    roots;
+    modelToPackageMap = null;
+    /** Lowercase lookup mirror of modelToPackageMap for case-insensitive resolve(). */
+    lowercaseLookup = null;
+    buildPromise = null;
+    constructor(roots) {
+        this.roots = roots.filter(Boolean);
+    }
+    /**
+     * Resolve a model name to its package name.
+     * Returns null if the model cannot be found in any root.
+     */
+    async resolve(modelName) {
+        await this.ensureBuilt();
+        return this.modelToPackageMap.get(modelName) ||
+            this.lowercaseLookup.get(modelName.toLowerCase()) ||
+            null;
+    }
+    /**
+     * Resolve with an explicit package name (bypasses lookup).
+     */
+    resolveWithPackage(modelName, packageName) {
+        return {
+            packageName,
+            modelName,
+            rootPath: this.roots[0] || '',
+        };
+    }
+    /**
+     * Get all known model-to-package mappings.
+     */
+    async getAllMappings() {
+        await this.ensureBuilt();
+        return new Map(this.modelToPackageMap);
+    }
+    /**
+     * Invalidate the cache to force a rescan.
+     */
+    clearCache() {
+        this.modelToPackageMap = null;
+        this.lowercaseLookup = null;
+        this.buildPromise = null;
+    }
+    async ensureBuilt() {
+        if (this.modelToPackageMap)
+            return;
+        if (!this.buildPromise) {
+            this.buildPromise = this.buildMap().catch((err) => {
+                this.buildPromise = null;
+                throw err;
+            });
+        }
+        await this.buildPromise;
+    }
+    async buildMap() {
+        const map = new Map();
+        const lcMap = new Map();
+        for (const rawRoot of this.roots) {
+            if (!rawRoot)
+                continue;
+            const root = normalizePathCase(rawRoot);
+            let packageDirs;
+            try {
+                const entries = await fs.readdir(root, { withFileTypes: true });
+                packageDirs = entries
+                    .filter(e => e.isDirectory() || e.isSymbolicLink())
+                    .map(e => e.name);
+            }
+            catch {
+                continue;
+            }
+            for (const pkgName of packageDirs) {
+                const pkgPath = path.join(root, pkgName);
+                // Strategy 1: descriptor XML files
+                const descriptorDir = path.join(pkgPath, 'Descriptor');
+                try {
+                    const descriptorFiles = await fs.readdir(descriptorDir);
+                    for (const file of descriptorFiles) {
+                        if (!file.endsWith('.xml'))
+                            continue;
+                        const filePath = path.join(descriptorDir, file);
+                        try {
+                            const content = await fs.readFile(filePath, 'utf-8');
+                            const nameMatch = content.match(/<Name>([^<]+)<\/Name>/);
+                            const moduleMatch = content.match(/<ModelModule>([^<]+)<\/ModelModule>/);
+                            const modelName = nameMatch?.[1]?.trim();
+                            const packageName = moduleMatch?.[1]?.trim() || pkgName;
+                            if (modelName && !map.has(modelName)) {
+                                const resolved = { packageName, modelName, rootPath: root };
+                                map.set(modelName, resolved);
+                                lcMap.set(modelName.toLowerCase(), resolved);
+                            }
+                        }
+                        catch {
+                            // Skip unreadable descriptor
+                        }
+                    }
+                }
+                catch {
+                    // No Descriptor directory -- fall through to filesystem scan
+                }
+                // Strategy 2: filesystem scan (subdirs containing an AOT-type folder)
+                try {
+                    const subEntries = await fs.readdir(pkgPath, { withFileTypes: true });
+                    const subDirs = subEntries
+                        .filter(e => e.isDirectory() || e.isSymbolicLink())
+                        .map(e => e.name)
+                        .filter(n => n !== 'Descriptor' && n !== 'bin' && !n.startsWith('.'));
+                    for (const subDir of subDirs) {
+                        const modelPath = path.join(pkgPath, subDir);
+                        const hasAotFolder = await this.hasAotTypeFolder(modelPath);
+                        if (hasAotFolder && !map.has(subDir)) {
+                            const resolved = { packageName: pkgName, modelName: subDir, rootPath: root };
+                            map.set(subDir, resolved);
+                            lcMap.set(subDir.toLowerCase(), resolved);
+                        }
+                    }
+                }
+                catch {
+                    // Skip unreadable package directory
+                }
+            }
+        }
+        this.modelToPackageMap = map;
+        this.lowercaseLookup = lcMap;
+    }
+    static AOT_FOLDERS = new Set([
+        'axclass', 'axtable', 'axenum', 'axform', 'axedt', 'axview', 'axdataentityview',
+    ]);
+    async hasAotTypeFolder(dirPath) {
+        try {
+            const entries = await fs.readdir(dirPath);
+            return entries.some(e => PackageResolver.AOT_FOLDERS.has(e.toLowerCase()));
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=packageResolver.js.map

package/dist/utils/packageResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageResolver.js","sourceRoot":"","sources":["../../src/utils/packageResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAQD,MAAM,OAAO,eAAe;IAClB,KAAK,CAAW;IAChB,iBAAiB,GAAwC,IAAI,CAAC;IACtE,mFAAmF;IAC3E,eAAe,GAAwC,IAAI,CAAC;IAC5D,YAAY,GAAyB,IAAI,CAAC;IAElD,YAAY,KAAe;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,iBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3C,IAAI,CAAC,eAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC;IACT,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,SAAiB,EAAE,WAAmB;QACvD,OAAO;YACL,WAAW;YACX,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAkB,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO;QACnC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;QAEjD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,WAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,WAAW,GAAG,OAAO;qBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;qBAClD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAEzC,mCAAmC;gBACnC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACvD,IAAI,CAAC;oBACH,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;oBACxD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;wBACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAAE,SAAS;wBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;wBAChD,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;4BACrD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;4BACzD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;4BAEzE,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;4BACzC,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;4BAExD,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gCACrC,MAAM,QAAQ,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gCAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gCAC7B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;4BAC/C,CAAC;wBACH,CAAC;wBAAC,MAAM,CAAC;4BACP,6BAA6B;wBAC/B,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;gBAC/D,CAAC;gBAED,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtE,MAAM,OAAO,GAAG,UAAU;yBACvB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;yBAClD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;yBAChB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;oBAExE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;wBAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;wBAC5D,IAAI,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BACrC,MAAM,QAAQ,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;4BAC7E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;4BAC1B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;wBAC5C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IAC/B,CAAC;IAEO,MAAM,CAAU,WAAW,GAAG,IAAI,GAAG,CAAC;QAC5C,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB;KAChF,CAAC,CAAC;IAEK,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/utils/pathContainment.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Path containment guard for D365FO write operations.
+ *
+ * All D365FO XML objects live at the canonical path:
+ *   <PackagesLocalDirectory>/<Package>/<Model>/Ax<Type>/<Name>.xml
+ *
+ * UDE layout is analogous under the custom packages root.
+ *
+ * This guard ensures that any file path the server is asked to write to
+ * actually resolves underneath one of the configured package roots AND
+ * contains the expected `/<Package>/<Model>/Ax*` segment shape. It prevents:
+ *   - path traversal via explicit filePath / sourcePath JSON
+ *   - writes to arbitrary locations on the host (repos, system dirs, etc.)
+ *   - silent drift between the "resolved model" and the actual on-disk model
+ *
+ * Security-wise this is the single authoritative place that decides whether
+ * a given absolute path is an acceptable write target.
+ */
+export interface PathContainmentResult {
+    ok: boolean;
+    /** When ok=false, human-readable reason. */
+    reason?: string;
+    /** When ok=true, the canonical absolute path with on-disk casing applied. */
+    canonicalPath?: string;
+    /** Matched root (for diagnostics). */
+    matchedRoot?: string;
+}
+/**
+ * Validate that `filePath` points at a D365FO AOT file inside an allowed root
+ * and matches the canonical `<root>/<Package>/<Model>/Ax<Type>/<Name>.xml` shape.
+ *
+ * `modelHint` (optional) is the model name the caller expects to modify; when
+ * provided we additionally require the path's model segment to match it
+ * (case-insensitive). This catches the agent-steered attack where `modelName`
+ * is one value but `filePath` points into a different (standard) model.
+ */
+export declare function assertWritePathAllowed(filePath: string, modelHint?: string, opts?: {
+    extraRoots?: (string | null | undefined)[];
+}): Promise<PathContainmentResult>;
+/** Throwing wrapper — convenient in tool handlers. */
+export declare function ensureWritePathAllowed(filePath: string, modelHint?: string, opts?: {
+    extraRoots?: (string | null | undefined)[];
+}): Promise<string>;
+/**
+ * Validate that `dirPath` is a directory inside one of the configured D365FO
+ * package roots. Used as the read-side equivalent of `assertWritePathAllowed`
+ * for workspace-scanning operations (`workspacePath` tool parameter).
+ *
+ * Prevents path traversal and arbitrary directory reads: any absolute path that
+ * does NOT resolve under a configured package root is rejected outright.
+ */
+export declare function assertReadRootAllowed(dirPath: string): Promise<PathContainmentResult>;
+/**
+ * Check that a single file path (e.g. a glob result) still resolves under
+ * `rootDir` after symlink resolution. Call this on every file returned by
+ * a glob that was rooted at a validated workspace path — a symlink inside
+ * the workspace could otherwise redirect a read outside the allowed root.
+ */
+export declare function isFileUnderRoot(filePath: string, rootDir: string): boolean;
+//# sourceMappingURL=pathContainment.d.ts.map

package/dist/utils/pathContainment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathContainment.d.ts","sourceRoot":"","sources":["../../src/utils/pathContainment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAiGD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,CAAA;CAAE,GACpD,OAAO,CAAC,qBAAqB,CAAC,CAkGhC;AAED,sDAAsD;AACtD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,CAAA;CAAE,GACpD,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyB3F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1E"}

package/dist/utils/pathContainment.js

@@ -0,0 +1,270 @@
+/**
+ * Path containment guard for D365FO write operations.
+ *
+ * All D365FO XML objects live at the canonical path:
+ *   <PackagesLocalDirectory>/<Package>/<Model>/Ax<Type>/<Name>.xml
+ *
+ * UDE layout is analogous under the custom packages root.
+ *
+ * This guard ensures that any file path the server is asked to write to
+ * actually resolves underneath one of the configured package roots AND
+ * contains the expected `/<Package>/<Model>/Ax*` segment shape. It prevents:
+ *   - path traversal via explicit filePath / sourcePath JSON
+ *   - writes to arbitrary locations on the host (repos, system dirs, etc.)
+ *   - silent drift between the "resolved model" and the actual on-disk model
+ *
+ * Security-wise this is the single authoritative place that decides whether
+ * a given absolute path is an acceptable write target.
+ */
+import * as path from 'path';
+import { realpathSync } from 'fs';
+import { getConfigManager, fallbackPackagePath } from './configManager.js';
+/**
+ * True when `p` looks absolute on either POSIX or Windows, regardless of host
+ * OS. The server routinely runs on Windows but tests (and Azure proxy) run on
+ * Linux/macOS against Windows-style paths — using only `path.isAbsolute` would
+ * reject valid production paths in those cross-platform contexts.
+ */
+function isAbsoluteCrossPlatform(p) {
+    if (!p)
+        return false;
+    if (path.isAbsolute(p))
+        return true;
+    // Windows drive letter (C:\...) or UNC (\\server\share\...)
+    return /^[a-zA-Z]:[\\/]/.test(p) || /^\\\\[^\\/]+[\\/][^\\/]+/.test(p);
+}
+function toAbsolute(p) {
+    return isAbsoluteCrossPlatform(p) ? p : path.resolve(p);
+}
+/** Absolute + POSIX separators, WITHOUT symlink resolution (the as-given form). */
+function lexicalNorm(p) {
+    if (!p)
+        return '';
+    return toAbsolute(p).replace(/\\/g, '/').replace(/\/+$/, '');
+}
+/** Absolute + POSIX separators WITH symlink resolution (realpath). */
+function realNorm(p) {
+    if (!p)
+        return '';
+    let abs = toAbsolute(p);
+    try {
+        abs = realpathSync(abs);
+    }
+    catch { /* may not exist yet — ok */ }
+    return abs.replace(/\\/g, '/').replace(/\/+$/, '');
+}
+/** Back-compat alias — defaults to the realpath form. */
+function normalise(p) {
+    return realNorm(p);
+}
+function startsUnder(child, parent) {
+    if (!parent)
+        return false;
+    const c = child.toLowerCase();
+    const p = parent.toLowerCase();
+    return c === p || c.startsWith(p + '/');
+}
+/**
+ * True when `child` is equal to or nested under `parent`, comparing BOTH the
+ * lexical (as-given) and realpath (symlink-resolved) forms of each side.
+ *
+ * A D365FO model directory is commonly a symlink (e.g.
+ * `…/PackagesLocalDirectory/<Model>` → a repo checkout), so a realpath-only
+ * comparison would wrongly reject a legitimate path reached through it.
+ * `..` traversal is still neutralised by path.resolve in both forms.
+ */
+function isUnder(child, parent) {
+    if (!parent)
+        return false;
+    const cl = lexicalNorm(child), cr = realNorm(child);
+    const pl = lexicalNorm(parent), pr = realNorm(parent);
+    return startsUnder(cl, pl) || startsUnder(cr, pr) || startsUnder(cl, pr) || startsUnder(cr, pl);
+}
+/**
+ * Build the list of allowed root directories for D365FO writes from config.
+ * Order: configured package path → UDE custom packages → UDE Microsoft packages → fallback.
+ * Empty/undefined entries are skipped.
+ */
+async function getAllowedRoots(extraRoots) {
+    const cfg = getConfigManager();
+    await cfg.ensureLoaded();
+    const roots = new Set();
+    // Store roots in lexical (as-configured) form; realpath form is derived per-comparison.
+    const add = (r) => { if (r && r.trim())
+        roots.add(lexicalNorm(r)); };
+    add(cfg.getPackagePath());
+    try {
+        add(await cfg.getCustomPackagesPath());
+    }
+    catch { /* optional */ }
+    try {
+        add(await cfg.getMicrosoftPackagesPath());
+    }
+    catch { /* optional */ }
+    // Caller-supplied roots (e.g. `packagePath` pointing at a repo checkout outside
+    // PackagesLocalDirectory) carry the same trust as a configured root; the
+    // canonical AOT-shape and model-hint checks below still apply to them.
+    for (const r of extraRoots ?? [])
+        add(r);
+    // Fallback only if nothing was configured — prevents writing to unrelated
+    // drives when config is silently missing.
+    if (roots.size === 0)
+        add(fallbackPackagePath());
+    // Broaden any package-level root up to its PackagesLocalDirectory base: a
+    // custom object commonly lives in a sibling package under the same PLD as an
+    // explicit single-package root. The canonical-AOT-shape and standard-model
+    // guards downstream still block writes into Microsoft-owned models.
+    for (const r of [...roots]) {
+        const m = r.match(/^(.*\/PackagesLocalDirectory)(?:\/|$)/i);
+        if (m && m[1] !== r)
+            roots.add(m[1]);
+    }
+    return [...roots];
+}
+/**
+ * Validate that `filePath` points at a D365FO AOT file inside an allowed root
+ * and matches the canonical `<root>/<Package>/<Model>/Ax<Type>/<Name>.xml` shape.
+ *
+ * `modelHint` (optional) is the model name the caller expects to modify; when
+ * provided we additionally require the path's model segment to match it
+ * (case-insensitive). This catches the agent-steered attack where `modelName`
+ * is one value but `filePath` points into a different (standard) model.
+ */
+export async function assertWritePathAllowed(filePath, modelHint, opts) {
+    if (!filePath || typeof filePath !== 'string') {
+        return { ok: false, reason: 'filePath is empty' };
+    }
+    if (!isAbsoluteCrossPlatform(filePath)) {
+        return { ok: false, reason: `filePath must be absolute: "${filePath}"` };
+    }
+    // Containment accepts either the lexical (as-given) or realpath form of the
+    // file path; the AOT-shape check below must slice with the SAME form that
+    // matched, so both are carried through instead of pre-collapsing to realpath.
+    const fileLex = lexicalNorm(filePath);
+    const fileReal = realNorm(filePath);
+    // 1. Root containment
+    const roots = await getAllowedRoots(opts?.extraRoots);
+    let matchedRoot;
+    let canonical = fileReal;
+    for (const r of roots) {
+        const rReal = realNorm(r);
+        if (startsUnder(fileLex, r) || startsUnder(fileLex, rReal)) {
+            matchedRoot = startsUnder(fileLex, r) ? r : rReal;
+            canonical = fileLex;
+            break;
+        }
+        if (startsUnder(fileReal, rReal) || startsUnder(fileReal, r)) {
+            matchedRoot = startsUnder(fileReal, rReal) ? rReal : r;
+            canonical = fileReal;
+            break;
+        }
+    }
+    if (!matchedRoot) {
+        // When the path still has the canonical <…>/<Package>/<Model>/Ax<Type>/<File>
+        // shape, the would-be package root is everything above <Package> — surface it
+        // as a copy-paste suggestion (common case: metadata outside PackagesLocalDirectory).
+        const segs = canonical.split('/').filter(Boolean);
+        const axIdx = segs.findIndex(s => /^Ax[A-Z]/.test(s));
+        const derivedRoot = axIdx >= 3 && axIdx === segs.length - 2 ? segs.slice(0, axIdx - 2).join('/') : '';
+        const suggestion = derivedRoot
+            ? `    This object's package root looks like: ${derivedRoot}\n` +
+                `    → per call:   packagePath="${derivedRoot}"\n` +
+                `    → persistent: set context.customPackagesPath / D365FO_CUSTOM_PACKAGES_PATH to it (and restart).\n`
+            : `    Set context.customPackagesPath / D365FO_CUSTOM_PACKAGES_PATH (and restart), ` +
+                `or pass packagePath="<root that contains the model>".\n`;
+        return {
+            ok: false,
+            reason: `Refusing to write outside configured D365FO package roots.\n` +
+                // Normalized path shown (forward slashes) — comparison is case-insensitive
+                // with separators normalized, so raw input slashes are irrelevant.
+                `  resolved path: ${canonical}\n` +
+                `  allowed roots:\n` +
+                (roots.length ? roots.map(r => `    - ${r}`).join('\n') : '    (none configured)') + '\n' +
+                `  → The file resolved under none of these roots (its model is not on an allowed root):\n` +
+                suggestion +
+                `    It is NOT a path-separator issue.`,
+        };
+    }
+    // 2. Canonical AOT shape:  <root>/<Package>/<Model>/Ax<Type>/<Name>.xml
+    // (UDE layout also matches because customPackagesPath is itself the <root>.)
+    const relative = canonical.slice(matchedRoot.length).replace(/^\/+/, '');
+    const parts = relative.split('/').filter(Boolean);
+    if (parts.length < 4) {
+        return {
+            ok: false,
+            reason: `Path does not match canonical AOT layout (<Package>/<Model>/Ax<Type>/<File>):\n  ${filePath}`,
+        };
+    }
+    const [, modelSeg, axFolder, lastSeg] = parts;
+    if (!/^Ax[A-Z]/.test(axFolder)) {
+        return {
+            ok: false,
+            reason: `Expected Ax* folder as 3rd segment, got "${axFolder}" — path: ${filePath}`,
+        };
+    }
+    if (!lastSeg.toLowerCase().endsWith('.xml') && !lastSeg.toLowerCase().endsWith('.xpp')) {
+        return {
+            ok: false,
+            reason: `Expected .xml/.xpp file, got "${lastSeg}" — path: ${filePath}`,
+        };
+    }
+    // 3. Optional model-hint cross-check
+    if (modelHint && modelHint.trim() && modelHint !== 'any') {
+        if (modelSeg.toLowerCase() !== modelHint.toLowerCase()) {
+            return {
+                ok: false,
+                reason: `Model mismatch: filePath is in model "${modelSeg}" but caller requested "${modelHint}". ` +
+                    `This usually means the agent passed filePath from a different object.`,
+            };
+        }
+    }
+    return { ok: true, canonicalPath: canonical, matchedRoot };
+}
+/** Throwing wrapper — convenient in tool handlers. */
+export async function ensureWritePathAllowed(filePath, modelHint, opts) {
+    const r = await assertWritePathAllowed(filePath, modelHint, opts);
+    if (!r.ok)
+        throw new Error(`⛔ Path containment check failed: ${r.reason}`);
+    return r.canonicalPath;
+}
+/**
+ * Validate that `dirPath` is a directory inside one of the configured D365FO
+ * package roots. Used as the read-side equivalent of `assertWritePathAllowed`
+ * for workspace-scanning operations (`workspacePath` tool parameter).
+ *
+ * Prevents path traversal and arbitrary directory reads: any absolute path that
+ * does NOT resolve under a configured package root is rejected outright.
+ */
+export async function assertReadRootAllowed(dirPath) {
+    if (!dirPath || typeof dirPath !== 'string') {
+        return { ok: false, reason: 'dirPath is empty' };
+    }
+    if (!isAbsoluteCrossPlatform(dirPath)) {
+        return { ok: false, reason: `dirPath must be absolute: "${dirPath}"` };
+    }
+    // dirPath is passed raw (not pre-realpath'd) so isUnder can match it lexically
+    // against an allowed root reached through a model-dir symlink.
+    const roots = await getAllowedRoots();
+    const matchedRoot = roots.find(r => isUnder(dirPath, r));
+    const canonical = normalise(dirPath);
+    if (!matchedRoot) {
+        return {
+            ok: false,
+            reason: `Refusing to scan outside configured D365FO package roots.\n` +
+                `  resolved path: ${canonical}\n` +
+                `  allowed roots:\n` +
+                (roots.length ? roots.map(r => `    - ${r}`).join('\n') : '    (none configured)'),
+        };
+    }
+    return { ok: true, canonicalPath: canonical, matchedRoot };
+}
+/**
+ * Check that a single file path (e.g. a glob result) still resolves under
+ * `rootDir` after symlink resolution. Call this on every file returned by
+ * a glob that was rooted at a validated workspace path — a symlink inside
+ * the workspace could otherwise redirect a read outside the allowed root.
+ */
+export function isFileUnderRoot(filePath, rootDir) {
+    return isUnder(filePath, rootDir);
+}
+//# sourceMappingURL=pathContainment.js.map

package/dist/utils/pathContainment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathContainment.js","sourceRoot":"","sources":["../../src/utils/pathContainment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAY3E;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,CAAS;IACxC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,4DAA4D;IAC5D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC;QAAC,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,UAA0C;IACvE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,wFAAwF;IACxF,MAAM,GAAG,GAAG,CAAC,CAA4B,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhG,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC;QAAC,GAAG,CAAC,MAAM,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACxE,IAAI,CAAC;QAAC,GAAG,CAAC,MAAM,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAE3E,gFAAgF;IAChF,yEAAyE;IACzE,uEAAuE;IACvE,KAAK,MAAM,CAAC,IAAI,UAAU,IAAI,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEzC,0EAA0E;IAC1E,0CAA0C;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEjD,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAkB,EAClB,IAAqD;IAErD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,QAAQ,GAAG,EAAE,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpC,sBAAsB;IACtB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,WAA+B,CAAC;IACpC,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,WAAW,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClD,SAAS,GAAG,OAAO,CAAC;YACpB,MAAM;QACR,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7D,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,8EAA8E;QAC9E,8EAA8E;QAC9E,qFAAqF;QACrF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,WAAW,GACf,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,UAAU,GAAG,WAAW;YAC5B,CAAC,CAAC,8CAA8C,WAAW,IAAI;gBAC7D,kCAAkC,WAAW,KAAK;gBAClD,uGAAuG;YACzG,CAAC,CAAC,kFAAkF;gBAClF,yDAAyD,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,8DAA8D;gBAC9D,2EAA2E;gBAC3E,mEAAmE;gBACnE,oBAAoB,SAAS,IAAI;gBACjC,oBAAoB;gBACpB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,IAAI;gBACzF,0FAA0F;gBAC1F,UAAU;gBACV,uCAAuC;SAC1C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,oFAAoF,QAAQ,EAAE;SACjG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4CAA4C,QAAQ,aAAa,QAAQ,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iCAAiC,OAAO,aAAa,QAAQ,EAAE;SACxE,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YACvD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,yCAAyC,QAAQ,2BAA2B,SAAS,KAAK;oBAC1F,uEAAuE;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAkB,EAClB,IAAqD;IAErD,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC,aAAc,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,OAAO,GAAG,EAAE,CAAC;IACzE,CAAC;IAED,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,6DAA6D;gBAC7D,oBAAoB,SAAS,IAAI;gBACjC,oBAAoB;gBACpB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAe;IAC/D,OAAO,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/utils/projectUtils.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared D365FO project utilities used by generateSmartTable.ts and generateSmartForm.ts.
+ */
+/**
+ * Extract model name from .rnrproj file.
+ * Returns null if the file cannot be read (e.g. Windows path on Linux) or
+ * if <ModelName> is not found — callers must handle null gracefully.
+ */
+export declare function extractModelFromProject(projectPath: string): string | null;
+/**
+ * Find .rnrproj file in solution directory.
+ */
+export declare function findProjectInSolution(solutionPath: string): string | null;
+//# sourceMappingURL=projectUtils.d.ts.map

package/dist/utils/projectUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectUtils.d.ts","sourceRoot":"","sources":["../../src/utils/projectUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB1E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAczE"}

package/dist/utils/projectUtils.js

@@ -0,0 +1,48 @@
+/**
+ * Shared D365FO project utilities used by generateSmartTable.ts and generateSmartForm.ts.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Extract model name from .rnrproj file.
+ * Returns null if the file cannot be read (e.g. Windows path on Linux) or
+ * if <ModelName> is not found — callers must handle null gracefully.
+ */
+export function extractModelFromProject(projectPath) {
+    // Windows paths (K:\...) are not accessible on non-Windows — skip silently
+    if (process.platform !== 'win32' && /^[A-Z]:\\/i.test(projectPath)) {
+        console.warn(`[projectUtils] Skipping .rnrproj read on non-Windows: ${projectPath}`);
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(projectPath, 'utf-8');
+        const match = content.match(/<ModelName>(.*?)<\/ModelName>/);
+        if (match && match[1]) {
+            return match[1];
+        }
+    }
+    catch (error) {
+        console.error(`Failed to extract model from ${projectPath}:`, error);
+    }
+    return null;
+}
+/**
+ * Find .rnrproj file in solution directory.
+ */
+export function findProjectInSolution(solutionPath) {
+    // Windows paths (K:\...) are not accessible on non-Windows — skip silently
+    if (process.platform !== 'win32' && /^[A-Z]:\\/i.test(solutionPath)) {
+        console.warn(`[projectUtils] Skipping solution scan on non-Windows: ${solutionPath}`);
+        return null;
+    }
+    try {
+        const files = fs.readdirSync(solutionPath, { recursive: true });
+        const projectFile = files.find(f => f.endsWith('.rnrproj'));
+        return projectFile ? path.join(solutionPath, projectFile) : null;
+    }
+    catch (error) {
+        console.error(`Failed to find project in ${solutionPath}:`, error);
+        return null;
+    }
+}
+//# sourceMappingURL=projectUtils.js.map

package/dist/utils/projectUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectUtils.js","sourceRoot":"","sources":["../../src/utils/projectUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,2EAA2E;IAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,yDAAyD,WAAW,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC7D,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,WAAW,GAAG,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,2EAA2E;IAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,yDAAyD,YAAY,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAa,CAAC;QAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,YAAY,GAAG,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/provenanceStore.d.ts

@@ -0,0 +1,54 @@
+/**
+ * In-memory provenance store for grounding tokens.
+ *
+ * A grounding token proves that the model queried the real D365FO codebase
+ * (via prepare_change) before generating extension code. Tokens expire after
+ * TTL_MS to prevent stale context being reused across sessions.
+ *
+ * Enforcement: when GROUNDING_ENFORCE=true, extension patterns in generate_object(mode="pattern")
+ * and extension objectTypes in create_d365fo_file will reject calls without a
+ * valid token.
+ */
+export interface ProvenanceContext {
+    goal: string;
+    objectName: string;
+    methodName?: string;
+    objectType?: string;
+    /** Proposed name of the new extension object, when supplied to prepare_change */
+    proposedName?: string;
+    /** Condensed facts gathered by prepare_change */
+    methodSignature?: string;
+    cocExtensions?: string;
+    extensionEligibility?: string;
+    recommendedStrategy?: string;
+    namingValidation?: string;
+    patterns?: string;
+}
+export interface ProvenanceBundle {
+    token: string;
+    context: ProvenanceContext;
+    timestamp: number;
+    expiresAt: number;
+}
+export declare function createProvenanceToken(context: ProvenanceContext): string;
+export declare function getProvenanceBundle(token: string): ProvenanceBundle | undefined;
+export declare function isValidToken(token: string): boolean;
+/**
+ * Check that a token was issued for the object actually being written.
+ *
+ * A token issued for `CustTable` is accepted for targets that EMBED that name
+ * at the start (`CustTable.ContosoExtension`, `CustTableContoso_Extension`, …)
+ * and for the proposedName recorded by prepare_change. D365FO extension naming
+ * always leads with the base object name, so a prefix match is used rather
+ * than a bare substring match. Names shorter than 4 chars are compared exactly
+ * to avoid trivial matches.
+ */
+export declare function tokenMatchesTarget(bundle: ProvenanceBundle, targetObjectName: string): boolean;
+export declare function enforceGrounding(groundingToken: string | undefined, operationDescription: string, targetObjectName?: string): {
+    isError: true;
+    content: [{
+        type: 'text';
+        text: string;
+    }];
+} | null;
+//# sourceMappingURL=provenanceStore.d.ts.map