fast-cxt-mcp 1.1.0 → 1.1.2

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "fast-cxt-mcp",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "AI-driven semantic code search MCP server (Node.js)",
   "type": "module",
   "main": "src/server.mjs",
   "bin": {
-    "fast-cxt-mcp": "src/server.mjs"
+    "fast-context-mcp": "src/server.mjs"
   },
   "files": [
     "src/",

package/src/core.mjs

@@ -12,7 +12,7 @@
  */
 
 import { readdirSync, existsSync, statSync } from "node:fs";
-import { resolve, join, relative, sep } from "node:path";
+import { resolve, join, relative, sep, isAbsolute } from "node:path";
 import { gzipSync } from "node:zlib";
 import { randomUUID } from "node:crypto";
 import { platform, arch, release, version as osVersion, hostname, cpus, totalmem } from "node:os";
@@ -925,22 +925,24 @@ function getRepoMap(projectRoot, targetDepth = 3, excludePaths = []) {
 function _parseAnswer(xmlText, projectRoot) {
   const files = [];
   const resolvedRoot = resolve(projectRoot);
-  const fileRegex = /<file\s+path="([^"]+)">([\s\S]*?)<\/file>/g;
+  const fileRegex = /<file\s+path=(["'])([^"']+)\1>([\s\S]*?)<\/file>/g;
   let fm;
   while ((fm = fileRegex.exec(xmlText)) !== null) {
-    const vpath = fm[1];
-    const rel = vpath.replace(/^\/codebase\/?/, "");
+    const vpath = fm[2];
+    let rel = vpath.replace(/^\/codebase[\/\\]?/, "");
+    rel = rel.replace(/^[\/\\]+/, "");
 
     // Path safety: reject traversal attempts (../) and paths outside project root
     const fullPath = resolve(projectRoot, rel);
-    if (!fullPath.startsWith(resolvedRoot + sep) && fullPath !== resolvedRoot) {
+    const relToRoot = relative(resolvedRoot, fullPath);
+    if (relToRoot === ".." || relToRoot.startsWith(`..${sep}`) || isAbsolute(relToRoot)) {
       continue;
     }
 
     const ranges = [];
     const rangeRegex = /<range>(\d+)-(\d+)<\/range>/g;
     let rm;
-    while ((rm = rangeRegex.exec(fm[2])) !== null) {
+    while ((rm = rangeRegex.exec(fm[3])) !== null) {
       ranges.push([parseInt(rm[1], 10), parseInt(rm[2], 10)]);
     }
 

package/src/executor.mjs

@@ -52,8 +52,12 @@ export class ToolExecutor {
    * @returns {string}
    */
   _real(virtual) {
-    if (virtual.startsWith("/codebase")) {
-      const rel = virtual.slice("/codebase".length).replace(/^\/+/, "");
+    // Guard against undefined/null from malformed AI responses
+    if (virtual == null || typeof virtual !== "string") {
+      return this.root;
+    }
+    if (virtual.startsWith("/codebase") || virtual.startsWith("\\codebase")) {
+      const rel = virtual.slice("/codebase".length).replace(/^[\/\\]+/, "");
       return join(this.root, rel);
     }
     return virtual;
@@ -122,6 +126,12 @@ export class ToolExecutor {
    * @returns {Promise<string>}
    */
   async rgAsync(pattern, path, include = null, exclude = null) {
+    if (!pattern || typeof pattern !== "string") {
+      return "Error: missing or invalid pattern";
+    }
+    if (!path || typeof path !== "string") {
+      return "Error: missing or invalid path";
+    }
     this.collectedRgPatterns.push(pattern);
     const rp = this._real(path);
     if (!existsSync(rp)) {
@@ -168,6 +178,12 @@ export class ToolExecutor {
    * @returns {string}
    */
   rg(pattern, path, include = null, exclude = null) {
+    if (!pattern || typeof pattern !== "string") {
+      return "Error: missing or invalid pattern";
+    }
+    if (!path || typeof path !== "string") {
+      return "Error: missing or invalid path";
+    }
     this.collectedRgPatterns.push(pattern);
     const rp = this._real(path);
     if (!existsSync(rp)) {
@@ -215,6 +231,9 @@ export class ToolExecutor {
    * @returns {string}
    */
   readfile(file, startLine = null, endLine = null) {
+    if (!file || typeof file !== "string") {
+      return "Error: missing or invalid file path";
+    }
     const rp = this._real(file);
     try {
       const stat = statSync(rp);
@@ -249,6 +268,9 @@ export class ToolExecutor {
    * @returns {string}
    */
   tree(path, levels = null) {
+    if (!path || typeof path !== "string") {
+      return "Error: missing or invalid path";
+    }
     const rp = this._real(path);
     try {
       const stat = statSync(rp);
@@ -284,6 +306,9 @@ export class ToolExecutor {
    * @returns {string}
    */
   ls(path, longFormat = false, allFiles = false) {
+    if (!path || typeof path !== "string") {
+      return "Error: missing or invalid path";
+    }
     const rp = this._real(path);
     try {
       const stat = statSync(rp);
@@ -341,11 +366,16 @@ export class ToolExecutor {
    * @returns {string}
    */
   glob(pattern, path, typeFilter = "all") {
+    if (!pattern || typeof pattern !== "string") {
+      return "Error: missing or invalid pattern";
+    }
+    if (!path || typeof path !== "string") {
+      return "Error: missing or invalid path";
+    }
     const rp = this._real(path);
 
     // Use recursive readdir + fnmatch since Node 22 globSync may not be available
     const matches = [];
-    const fullPattern = join(rp, pattern).replace(/\\/g, "/");
 
     try {
       _globWalk(rp, pattern, matches, typeFilter);