kibi-mcp 3.16.0 → 3.16.1

package/dist/tools/symbols.js

@@ -20,6 +20,7 @@ import { access, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { dump as dumpYAML, load as parseYAML } from "js-yaml";
 import { enrichSymbolCoordinates, withSymbolCompilerLock, } from "kibi-runtime";
+import { resolveWorkspaceSourceAbsolute } from "../workspace-path.js";
 import { resolveWorkspaceRoot } from "../workspace.js";
 const SYMBOL_COORDINATES_FORMAT_VERSION = 2;
 const SYMBOL_COORDINATES_COMMENT_BLOCK = `# symbol-coordinates.yaml
@@ -214,10 +215,8 @@ function hasGeneratedCoordinates(entry) {
 async function isEligible(sourceFile, workspaceRoot) {
     if (!sourceFile)
         return false;
-    const absolute = path.isAbsolute(sourceFile)
-        ? sourceFile
-        : path.resolve(workspaceRoot, sourceFile);
-    if (!(await fileExists(absolute)))
+    const absolute = resolveWorkspaceSourceAbsolute(workspaceRoot, sourceFile);
+    if (absolute === null || !(await fileExists(absolute)))
         return false;
     return SOURCE_EXTENSIONS.has(path.extname(absolute).toLowerCase());
 }
@@ -253,9 +252,10 @@ async function fillMissingCoordinates(before, after, workspaceRoot) {
     if (!sourceFile) {
         return after;
     }
-    const absolutePath = path.isAbsolute(sourceFile)
-        ? sourceFile
-        : path.resolve(workspaceRoot, sourceFile);
+    const absolutePath = resolveWorkspaceSourceAbsolute(workspaceRoot, sourceFile);
+    if (absolutePath === null) {
+        return after;
+    }
     try {
         const content = await readFile(absolutePath, "utf8");
         const lines = content.split(/\r?\n/);
@@ -357,9 +357,9 @@ function coordinateSourceHash(sourceText) {
     return createHash("sha256").update(sourceText).digest("hex");
 }
 async function readSourceText(sourceFile, workspaceRoot) {
-    const absolutePath = path.isAbsolute(sourceFile)
-        ? sourceFile
-        : path.resolve(workspaceRoot, sourceFile);
+    const absolutePath = resolveWorkspaceSourceAbsolute(workspaceRoot, sourceFile);
+    if (absolutePath === null)
+        return null;
     try {
         return await readFile(absolutePath, "utf8");
     }

package/dist/workspace-path.js

@@ -0,0 +1,69 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+import { realpathSync } from "node:fs";
+import path from "node:path";
+/**
+ * Canonical repository-relative form of a recorded path. Returns null when the
+ * candidate escapes `workspaceRoot` (absolute foreign path, `..` segment).
+ * Kept in lockstep with packages/cli/src/utils/repo-relative-path.ts.
+ */
+export function normalizeRepoRelativePath(workspaceRoot, candidate) {
+    if (candidate.trim() === "")
+        return null;
+    let slashed = candidate.replaceAll("\\", "/");
+    const foreignAbsolute = /^[A-Za-z]:\//.test(slashed) || slashed.startsWith("//");
+    if (slashed.startsWith("/") || foreignAbsolute) {
+        if (foreignAbsolute && path.sep === "/")
+            return null;
+        const root = path.resolve(workspaceRoot);
+        const relative = path.relative(root, path.resolve(candidate));
+        if (relative === "" || path.isAbsolute(relative))
+            return null;
+        slashed = relative.replaceAll("\\", "/");
+    }
+    const normalized = path.posix.normalize(slashed).replace(/\/+$/, "");
+    if (normalized === "" ||
+        normalized === "." ||
+        normalized === ".." ||
+        normalized.startsWith("../")) {
+        return null;
+    }
+    return normalized;
+}
+/**
+ * Resolve a recorded source path to an absolute path confined under
+ * `workspaceRoot`. Returns null for escapes; callers must not read on null.
+ */
+// implements REQ-symbol-sourcefile-workspace-confinement
+export function resolveWorkspaceSourceAbsolute(workspaceRoot, sourceFile) {
+    const relative = normalizeRepoRelativePath(workspaceRoot, sourceFile);
+    if (relative === null)
+        return null;
+    const absolute = path.resolve(workspaceRoot, relative);
+    try {
+        const realRoot = realpathSync.native(path.resolve(workspaceRoot));
+        const realFile = realpathSync.native(absolute);
+        const confined = path.relative(realRoot, realFile);
+        if (confined.startsWith("..") || path.isAbsolute(confined))
+            return null;
+        return realFile;
+    }
+    catch {
+        return absolute;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-mcp",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "mcpName": "io.github.Looted/kibi-mcp",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
@@ -10,9 +10,9 @@
     "fast-glob": "^3.2.12",
     "gray-matter": "^4.0.3",
     "js-yaml": "^4.1.0",
-    "kibi-runtime": "^2.18.0",
-    "kibi-core": "^0.22.3",
-    "zod": "^4.3.6"
+    "kibi-runtime": "^2.18.1",
+    "kibi-core": "^0.22.4",
+    "zod": "^4.6.7"
   },
   "type": "module",
   "description": "Model Context Protocol server for Kibi knowledge base",