gossipcat 0.4.4 → 0.4.6

package/dist-mcp/mcp-server.js

@@ -3836,8 +3836,9 @@ var init_file_tools = __esm({
       constructor(sandbox) {
         this.sandbox = sandbox;
       }
-      async fileRead(args) {
-        const absPath = this.sandbox.validatePath(args.path);
+      async fileRead(args, agentRoot) {
+        const allowed = agentRoot ? [agentRoot] : [];
+        const absPath = this.sandbox.validatePath(args.path, allowed);
         try {
           const content = await (0, import_promises.readFile)(absPath, "utf-8");
           const lines = content.split("\n");
@@ -3854,25 +3855,29 @@ var init_file_tools = __esm({
           throw err;
         }
       }
-      async fileWrite(args) {
-        const absPath = this.sandbox.validatePath(args.path);
+      async fileWrite(args, agentRoot) {
+        const allowed = agentRoot ? [agentRoot] : [];
+        const absPath = this.sandbox.validatePath(args.path, allowed);
         const dir = (0, import_path3.resolve)(absPath, "..");
         await (0, import_promises.mkdir)(dir, { recursive: true });
         await (0, import_promises.writeFile)(absPath, args.content, "utf-8");
         return `Written ${args.content.length} bytes to ${args.path}`;
       }
-      async fileDelete(args) {
-        const absPath = this.sandbox.validatePath(args.path);
+      async fileDelete(args, agentRoot) {
+        const allowed = agentRoot ? [agentRoot] : [];
+        const absPath = this.sandbox.validatePath(args.path, allowed);
         await (0, import_promises.unlink)(absPath);
         return `Deleted ${args.path}`;
       }
-      async fileSearch(args) {
+      async fileSearch(args, agentRoot) {
         const results = [];
-        await this.walkDir(this.sandbox.projectRoot, args.pattern, results, 0, 10);
+        const root = agentRoot || this.sandbox.projectRoot;
+        await this.walkDir(root, args.pattern, results, 0, 10);
         return results.join("\n") || "No files found";
       }
-      async fileGrep(args) {
-        const searchRoot = args.path ? this.sandbox.validatePath(args.path) : this.sandbox.projectRoot;
+      async fileGrep(args, agentRoot) {
+        const allowed = agentRoot ? [agentRoot] : [];
+        const searchRoot = args.path ? this.sandbox.validatePath(args.path, allowed) : agentRoot || this.sandbox.projectRoot;
         let regex;
         try {
           regex = new RegExp(args.pattern);
@@ -3883,8 +3888,9 @@ var init_file_tools = __esm({
         await this.grepDir(searchRoot, regex, results, 0, 10);
         return results.join("\n") || "No matches found";
       }
-      async fileTree(args) {
-        const root = args.path ? this.sandbox.validatePath(args.path) : this.sandbox.projectRoot;
+      async fileTree(args, agentRoot) {
+        const allowed = agentRoot ? [agentRoot] : [];
+        const root = args.path ? this.sandbox.validatePath(args.path, allowed) : agentRoot || this.sandbox.projectRoot;
         const maxDepth = args.depth || 3;
         const lines = [];
         await this.buildTree(root, "", lines, 0, maxDepth);
@@ -4218,12 +4224,19 @@ var init_skill_tools = __esm({
 });
 
 // packages/tools/src/sandbox.ts
-var import_path5, import_fs4, Sandbox;
+function fold(p) {
+  return CASE_INSENSITIVE_FS ? p.toLowerCase() : p;
+}
+function rootWithSlash(p) {
+  return p.endsWith("/") ? p : p + "/";
+}
+var import_path5, import_fs4, CASE_INSENSITIVE_FS, Sandbox;
 var init_sandbox = __esm({
   "packages/tools/src/sandbox.ts"() {
     "use strict";
     import_path5 = require("path");
     import_fs4 = require("fs");
+    CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
     Sandbox = class {
       root;
       constructor(projectRoot) {
@@ -4233,12 +4246,26 @@ var init_sandbox = __esm({
         return this.root;
       }
       /**
-       * Validate that a path resolves within the project root.
-       * Handles non-existent files (for file_write) by walking up to the
-       * deepest existing ancestor and resolving from there.
-       * Resolves symlinks to prevent symlink escape attacks.
+       * Validate that a path resolves within the project root OR inside any
+       * entry in `allowedRoots` (union-of-roots). Handles non-existent files
+       * (for file_write) by walking up to the deepest existing ancestor and
+       * resolving from there. Resolves symlinks BEFORE the membership check
+       * to prevent symlink escape attacks.
+       *
+       * Preserves these security properties:
+       *   - path.resolve() on candidate AND every allowed root before compare
+       *   - realpathSync on deepest existing ancestor of candidate
+       *   - trailing-slash canonical form on root side (blocks sibling-prefix
+       *     bypass like `/tmp/gossip-wt-AB` vs `/tmp/gossip-wt-ABXYZ`)
+       *   - case-fold on darwin/win32
+       *
+       * @param filePath  Path to validate. May be relative (resolved against
+       *                  projectRoot) or absolute.
+       * @param allowedRoots Optional absolute paths that should also be
+       *                  accepted as roots. Defaults to `[]` so existing
+       *                  callers are unchanged.
        */
-      validatePath(filePath) {
+      validatePath(filePath, allowedRoots = []) {
         const resolved = (0, import_path5.resolve)(this.root, filePath);
         let checkPath = resolved;
         while (!(0, import_fs4.existsSync)(checkPath)) {
@@ -4249,10 +4276,27 @@ var init_sandbox = __esm({
         const real = (0, import_fs4.existsSync)(checkPath) ? (0, import_fs4.realpathSync)(checkPath) : checkPath;
         const remainder = resolved.slice(checkPath.length);
         const fullReal = real + remainder;
-        if (!fullReal.startsWith(this.root + "/") && fullReal !== this.root) {
-          throw new Error(`Path "${filePath}" resolves outside project root`);
+        const candidateRoots = [this.root];
+        for (const r of allowedRoots) {
+          if (!r) continue;
+          const absR = (0, import_path5.resolve)(r);
+          const realR = (0, import_fs4.existsSync)(absR) ? (() => {
+            try {
+              return (0, import_fs4.realpathSync)(absR);
+            } catch {
+              return absR;
+            }
+          })() : absR;
+          candidateRoots.push(realR);
+        }
+        const foldedFull = fold(fullReal);
+        for (const r of candidateRoots) {
+          const foldedRoot = fold(r);
+          if (foldedFull === foldedRoot) return fullReal;
+          if (foldedFull.startsWith(rootWithSlash(foldedRoot))) return fullReal;
         }
-        return fullReal;
+        const msg = allowedRoots.length > 0 ? `Path "${filePath}" resolves outside project root or agent root` : `Path "${filePath}" resolves outside project root`;
+        throw new Error(msg);
       }
     };
   }
@@ -8478,19 +8522,19 @@ function canonicalizeForBoundary(p) {
       }
     }
   }
-  if (CASE_INSENSITIVE_FS) out = out.toLowerCase();
+  if (CASE_INSENSITIVE_FS2) out = out.toLowerCase();
   return out.endsWith("/") ? out : out + "/";
 }
 function validatePathInScope(scope, canonicalPath) {
   return canonicalPath.startsWith(scope);
 }
-var import_path6, import_fs5, CASE_INSENSITIVE_FS;
+var import_path6, import_fs5, CASE_INSENSITIVE_FS2;
 var init_scope = __esm({
   "packages/tools/src/scope.ts"() {
     "use strict";
     import_path6 = require("path");
     import_fs5 = require("fs");
-    CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
+    CASE_INSENSITIVE_FS2 = process.platform === "darwin" || process.platform === "win32";
   }
 });
 
@@ -8742,7 +8786,7 @@ var init_tool_server = __esm({
                 throw new Error(`Read blocked: "${args.path}" is outside scope "${readScope}"`);
               }
             }
-            return this.fileTools.fileRead(args);
+            return this.fileTools.fileRead(args, agentRoot);
           }
           case "file_write": {
             if (callerId) {
@@ -8752,20 +8796,20 @@ var init_tool_server = __esm({
                 throw new Error(`Agent ${callerId} exceeded max tracked file writes (${_ToolServer.MAX_WRITTEN_FILES_PER_AGENT})`);
               }
             }
-            const result = await this.fileTools.fileWrite(args);
+            const result = await this.fileTools.fileWrite(args, agentRoot);
             if (callerId) {
               this.agentWrittenFiles.get(callerId).add(args.path);
             }
             return result;
           }
           case "file_delete":
-            return this.fileTools.fileDelete(args);
+            return this.fileTools.fileDelete(args, agentRoot);
           case "file_search":
-            return this.fileTools.fileSearch(args);
+            return this.fileTools.fileSearch(args, agentRoot);
           case "file_grep":
-            return this.fileTools.fileGrep(args);
+            return this.fileTools.fileGrep(args, agentRoot);
           case "file_tree":
-            return this.fileTools.fileTree(args);
+            return this.fileTools.fileTree(args, agentRoot);
           case "shell_exec":
             return this.shellTools.shellExec({
               ...args,
@@ -9224,7 +9268,7 @@ var init_definitions = __esm({
 var src_exports2 = {};
 __export(src_exports2, {
   ALL_TOOLS: () => ALL_TOOLS,
-  CASE_INSENSITIVE_FS: () => CASE_INSENSITIVE_FS,
+  CASE_INSENSITIVE_FS: () => CASE_INSENSITIVE_FS2,
   FILE_TOOLS: () => FILE_TOOLS,
   FileTools: () => FileTools,
   GIT_TOOLS: () => GIT_TOOLS,
@@ -21573,6 +21617,13 @@ function buildAuditExclusions(projectRoot, ownWorktree) {
   const root = canonicalize(projectRoot);
   for (const v of expandTmpVariants(`${root}/.gossip`)) excl.add(v);
   for (const v of expandTmpVariants(`${root}/.claude`)) excl.add(v);
+  try {
+    const home = canonicalize((0, import_os2.homedir)());
+    for (const sub of ["Library", ".cache", ".npm", ".claude/projects"]) {
+      for (const v of expandTmpVariants(`${home}/${sub}`)) excl.add(v);
+    }
+  } catch {
+  }
   if (ownWorktree) {
     const wt = canonicalize(ownWorktree);
     for (const v of expandTmpVariants(wt)) excl.add(v);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gossipcat",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch",
   "mcpName": "io.github.ataberk-xyz/gossipcat",
   "repository": {