ftp-mcp 1.5.1 → 1.5.3

package/index.js

@@ -313,6 +313,45 @@ function assertSafeRemotePath(remotePath) {
   }
 }
 
+/**
+ * Ensures that a specific remote directory exists.
+ * For standard FTP, this utility also handles the crucial reset of the 
+ * Current Working Directory (CWD) to prevent implicit state leakage.
+ */
+async function safeMkdir(client, useSFTP, remotePath) {
+  if (!remotePath || remotePath === '.' || remotePath === '/') return;
+
+  if (useSFTP) {
+    // SFTP mkdir with recursive: true
+    await client.mkdir(remotePath, true).catch(() => {});
+  } else {
+    // FTP ensureDir switches CWD; we MUST reset it.
+    try {
+      await client.ensureDir(remotePath);
+      if (client._initialPwd) {
+        await client.cd(client._initialPwd).catch(() => {});
+      }
+    } catch (e) {
+      // Some servers might error if directory already exists or permissions are weird
+    }
+  }
+}
+
+/**
+ * Ensures that the parent directory structure of a remote file path exists.
+ */
+async function ensureRemoteDir(client, useSFTP, remotePath) {
+  // remotePath could be a filename or a path like "dir/subdir/file.js"
+  // We extract the directory portion using forward-slash splitting.
+  const parts = remotePath.split('/');
+  if (parts.length <= 1) return; // Root or simple filename, nothing to ensure
+  
+  const dirName = parts.slice(0, -1).join('/');
+  if (!dirName || dirName === '.' || dirName === '/') return;
+
+  await safeMkdir(client, useSFTP, dirName);
+}
+
 function shouldIgnore(filePath, ignorePatterns, basePath) {
   const relativePath = path.relative(basePath, filePath).replace(/\\/g, '/');
 
@@ -333,6 +372,9 @@ const ProfileConfigSchema = z.object({
   password: z.string().optional(),
   port: z.union([z.string(), z.number()]).optional(),
   secure: z.union([z.boolean(), z.literal("implicit")]).optional(),
+  secureOptions: z.record(z.any()).optional(),
+  verbose: z.boolean().optional(),
+  timeout: z.number().optional(),
   readOnly: z.boolean().optional(),
   privateKey: z.string().optional(),
   passphrase: z.string().optional(),
@@ -396,8 +438,9 @@ async function loadFTPConfig(profileName = null, forceEnv = false) {
 
 function getPort(host, configPort) {
   if (configPort) return parseInt(configPort, 10);
-  // LOW-4: Use strict prefix check, not includes() which matches e.g. "mysftp-server.com"
+  // LOW-4: Use strict prefix check
   if (host && host.startsWith('sftp://')) return 22;
+  if (host && host.startsWith('ftp://')) return 21;
   return 21;
 }
 
@@ -409,13 +452,32 @@ function isSFTP(host) {
 async function connectFTP(config) {
   const client = new FTPClient();
   client.ftp.verbose = false;
+
+  if (config.verbose) {
+    client.ftp.log = (msg) => {
+      server.sendLoggingMessage({
+        level: "debug",
+        data: { message: `[FTP-RAW] ${msg}` }
+      });
+    };
+  }
+
   await client.access({
-    host: config.host,
+    host: config.host.replace('ftp://', '').replace('sftp://', ''), // Strip protocol for basic-ftp
     user: config.user,
     password: config.password,
     port: getPort(config.host, config.port),
-    secure: config.secure || false
+    secure: config.secure || false,
+    secureOptions: config.secureOptions || { rejectUnauthorized: false }, // Default to false for easy dev if not specified
+    timeout: config.timeout || 30000 // 30s connection timeout
   });
+
+  try {
+    client._initialPwd = await client.pwd();
+  } catch (e) {
+    client._initialPwd = '/'; // fallback if pwd fails
+  }
+
   return client;
 }
 
@@ -512,7 +574,7 @@ async function getClient(config) {
       telemetry.activeConnections++;
 
       client._isSFTP = useSFTP;
-      
+
       // Silence MaxListenersExceededWarning during high-activity syncs/sessions
       if (typeof client.setMaxListeners === 'function') {
         client.setMaxListeners(100);
@@ -527,7 +589,7 @@ async function getClient(config) {
         async execute(task) {
           // Use a simple promise chain to serialize operations on this client
           const result = this.promiseQueue.then(() => task(this.client));
-          this.promiseQueue = result.catch(() => {}); // Continue queue even on error
+          this.promiseQueue = result.catch(() => { }); // Continue queue even on error
           return result;
         }
       };
@@ -657,8 +719,34 @@ async function syncFiles(client, useSFTP, localPath, remotePath, direction, igno
     ignorePatterns = await loadIgnorePatterns(localPath);
     basePath = localPath;
     _isTopLevel = true;
+
+    // --- ANTI-RECURSION GUARD ---
+    // If we're syncing the current directory (.), and the remote target is a local folder (e.g. 'FlowdexMCP_LiveTest'),
+    // we MUST ignore the remote target folder locally so we don't upload it into itself forever.
+    // This caused more issues than I'm willing to admit.
+    const resolvedLocal = path.resolve(localPath);
+    // Rough check: if remotePath is just a folder name (no slashes) or a relative path, ignore it
+    if (remotePath && typeof remotePath === 'string' && !remotePath.startsWith('/')) {
+      const firstFolder = remotePath.split('/')[0];
+      if (firstFolder && firstFolder !== '.') {
+        ignorePatterns.push(firstFolder);
+        ignorePatterns.push(`${firstFolder}/**`);
+
+        // Re-instantiate the Ignore instance since we appended pattern strings
+        if (ignorePatterns._ig) delete ignorePatterns._ig;
+
+        server.notification({
+          method: "notifications/message",
+          params: {
+            level: "info",
+            data: { message: `[SYNC GUARD] Excluded target '${firstFolder}' from local sync to prevent infinite recursion.` }
+          }
+        });
+      }
+    }
+
     if (useManifest) await syncManifestManager.load();
-    
+
     // Initialize progress tracking if a token is provided
     if (progressState && progressState.token) {
       server.notification({
@@ -675,6 +763,7 @@ async function syncFiles(client, useSFTP, localPath, remotePath, direction, igno
 
   if (extraExclude.length > 0) {
     ignorePatterns = [...ignorePatterns, ...extraExclude];
+    if (ignorePatterns._ig) delete ignorePatterns._ig;
   }
 
   if (direction === 'upload' || direction === 'both') {
@@ -700,11 +789,7 @@ async function syncFiles(client, useSFTP, localPath, remotePath, direction, igno
       try {
         if (file.isDirectory()) {
           if (!dryRun) {
-            if (useSFTP) {
-              await client.mkdir(remoteFilePath, true);
-            } else {
-              await client.ensureDir(remoteFilePath);
-            }
+            await safeMkdir(client, useSFTP, remoteFilePath);
           }
           const subStats = await syncFiles(client, useSFTP, localFilePath, remoteFilePath, direction, ignorePatterns, basePath, extraExclude, dryRun, useManifest, false, progressState);
           stats.uploaded += subStats.uploaded;
@@ -726,9 +811,18 @@ async function syncFiles(client, useSFTP, localPath, remotePath, direction, igno
 
           if (shouldUpload) {
             try {
-              const remoteStat = useSFTP
-                ? await client.stat(remoteFilePath)
-                : (await client.list(remotePath)).find(f => f.name === file.name);
+              let remoteStat = undefined;
+              if (useSFTP) {
+                remoteStat = await client.stat(remoteFilePath).catch(() => undefined);
+              } else {
+                // To avoid 1,000 MLSD calls, we fetch the directory list once if not cached
+                let dirList = getCached(`sync-${client.ftp?.host || 'local'}`, 'LIST', remotePath);
+                if (!dirList) {
+                  dirList = await client.list(remotePath).catch(() => []);
+                  setCached(`sync-${client.ftp?.host || 'local'}`, 'LIST', remotePath, dirList);
+                }
+                remoteStat = dirList.find(f => f.name === file.name);
+              }
 
               if (remoteStat) {
                 const remoteTime = remoteStat.modifyTime || remoteStat.modifiedAt || new Date(remoteStat.rawModifiedAt);
@@ -1396,7 +1490,7 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
   if (request.params.uri === "mcp://instruction/server-state") {
     const isReadOnly = currentConfig?.readOnly || false;
     const protocol = currentConfig?.host?.startsWith('sftp://') ? 'SFTP' : 'FTP';
-    
+
     const content = `# ftp-mcp Server Context (Agent Guide)
 **Current Version:** ${SERVER_VERSION}
 **Active Profile:** ${currentProfile || 'Environment Variables'}
@@ -1439,7 +1533,7 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
     } catch (e) {
       throw new Error(`Policy Violation: ${e.message}`);
     }
-    
+
     try {
       const entry = await getClient(currentConfig);
       const content = await entry.execute(async (client) => {
@@ -1763,28 +1857,28 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
   try {
     const entry = await getClient(currentConfig);
-  const client = entry.client;
-  const useSFTP = client._isSFTP;
-  const poolKey = getPoolKey(currentConfig);
-  const cmdName = request.params.name;
-  const isDestructive = ["ftp_deploy", "ftp_put_contents", "ftp_batch_upload", "ftp_sync", "ftp_upload", "ftp_delete", "ftp_mkdir", "ftp_rmdir", "ftp_chmod", "ftp_rename", "ftp_copy", "ftp_patch_file"].includes(cmdName);
-
-  const policyEngine = new PolicyEngine(currentConfig || {});
-
-  if (isDestructive) {
-    if (currentConfig.readOnly) {
-      const errorResp = {
-        content: [{ type: "text", text: `Error: Profile '${currentProfile}' is configured in readOnly mode. Destructive actions are disabled.` }],
-        isError: true
-      };
-      await auditLog(cmdName, request.params.arguments, 'failed', currentProfile, 'readOnly mode violation');
-      return errorResp;
+    const client = entry.client;
+    const useSFTP = client._isSFTP;
+    const poolKey = getPoolKey(currentConfig);
+    const cmdName = request.params.name;
+    const isDestructive = ["ftp_deploy", "ftp_put_contents", "ftp_batch_upload", "ftp_sync", "ftp_upload", "ftp_delete", "ftp_mkdir", "ftp_rmdir", "ftp_chmod", "ftp_rename", "ftp_copy", "ftp_patch_file"].includes(cmdName);
+
+    const policyEngine = new PolicyEngine(currentConfig || {});
+
+    if (isDestructive) {
+      if (currentConfig.readOnly) {
+        const errorResp = {
+          content: [{ type: "text", text: `Error: Profile '${currentProfile}' is configured in readOnly mode. Destructive actions are disabled.` }],
+          isError: true
+        };
+        await auditLog(cmdName, request.params.arguments, 'failed', currentProfile, 'readOnly mode violation');
+        return errorResp;
+      }
+      invalidatePoolCache(poolKey);
     }
-    invalidatePoolCache(poolKey);
-  }
 
-  const response = await entry.execute(async (client) => {
-    switch (cmdName) {
+    const response = await entry.execute(async (client) => {
+      switch (cmdName) {
         case "ftp_list": {
           const path = request.params.arguments?.path || ".";
           const limit = request.params.arguments?.limit || 100;
@@ -1804,7 +1898,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const isDir = (useSFTP ? f.type === 'd' : f.isDirectory);
             const icon = isDir ? ICON.DIR : ICON.FILE;
             const label = isDir ? '[DIR] ' : '[FILE]';
-            
+
             let marker = "";
             const nameLower = f.name.toLowerCase();
             if (['package.json', 'composer.json', 'requirements.txt', 'pyproject.toml', 'go.mod'].includes(nameLower)) marker = ` ${ICON.PKG}`;
@@ -1917,6 +2011,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           if (createBackup) {
             const backupPath = `${filePath}.bak`;
+            await ensureRemoteDir(client, useSFTP, backupPath);
             if (useSFTP) {
               const buffer = Buffer.from(content, 'utf8');
               await client.put(buffer, backupPath);
@@ -1926,6 +2021,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
           }
 
+          await ensureRemoteDir(client, useSFTP, filePath);
           if (useSFTP) {
             const buffer = Buffer.from(patchedContent, 'utf8');
             await client.put(buffer, filePath);
@@ -1950,6 +2046,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           const txId = await snapshotManager.createSnapshot(client, useSFTP, [filePath]);
 
+          await ensureRemoteDir(client, useSFTP, filePath);
+
           if (useSFTP) {
             const buffer = Buffer.from(content, 'utf8');
             await client.put(buffer, filePath);
@@ -2300,6 +2398,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
               continue;
             }
             try {
+              await ensureRemoteDir(client, useSFTP, file.remotePath);
               if (useSFTP) {
                 await client.put(file.localPath, file.remotePath);
               } else {
@@ -2484,6 +2583,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           const txIdUpload = await snapshotManager.createSnapshot(client, useSFTP, [remotePath]);
 
+          await ensureRemoteDir(client, useSFTP, remotePath);
+
           if (useSFTP) {
             await client.put(localPath, remotePath);
           } else {
@@ -2544,11 +2645,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         case "ftp_mkdir": {
           const { path } = request.params.arguments;
 
-          if (useSFTP) {
-            await client.mkdir(path, true);
-          } else {
-            await client.ensureDir(path);
-          }
+          await safeMkdir(client, useSFTP, path);
 
           return {
             content: [{ type: "text", text: `Successfully created directory ${path}` }]
@@ -2615,6 +2712,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
           const txId = await snapshotManager.createSnapshot(client, useSFTP, [oldPath, newPath]);
 
+          await ensureRemoteDir(client, useSFTP, newPath);
           await client.rename(oldPath, newPath);
 
           return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ftp-mcp",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "Enterprise-grade MCP server providing heavily optimized FTP/SFTP operations with smart sync, patch/chunk streaming, caching, and explicit read-only security mappings for AI code assistants.",
   "type": "module",
   "main": "index.js",