minutes-mcp 0.9.2 → 0.9.3

package/dist/index.js

@@ -148,7 +148,7 @@ function findMinutesBinary() {
 }
 let MINUTES_BIN = findMinutesBinary();
 // ── Expected CLI version (must match this MCP server release) ──
-const MCP_SERVER_VERSION = "0.9.2";
+const MCP_SERVER_VERSION = "0.9.3";
 const EXPECTED_CLI_VERSION = MCP_SERVER_VERSION;
 const RELEASE_TAG = `v${EXPECTED_CLI_VERSION}`;
 // ── CLI auto-install ────────────────────────────────────────

package/dist/paths.js

@@ -1,6 +1,6 @@
 import { existsSync, realpathSync } from "fs";
 import { homedir } from "os";
-import { extname, join, resolve } from "path";
+import { extname, join, resolve, sep } from "path";
 export function expandHomeLikePath(input) {
     const home = homedir();
     if (input === "~") {
@@ -31,7 +31,9 @@ export function canonicalizeRoot(root) {
 }
 export function isWithinDirectory(candidate, root) {
     // Ensure root ends with separator to prevent prefix attacks (e.g. ~/meetings-evil)
-    const rootWithSep = root.endsWith("/") ? root : root + "/";
+    // Use path.sep for cross-platform correctness — realpathSync returns OS-native
+    // separators, so on Windows the root will use backslashes.
+    const rootWithSep = root.endsWith(sep) ? root : root + sep;
     return candidate === root || candidate.startsWith(rootWithSep);
 }
 export function validatePathInDirectory(path, root, allowedExts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minutes-mcp",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "MCP server for minutes — conversation memory for AI assistants. Works with Claude Desktop, Mistral Vibe, Cursor, Windsurf, and any MCP client.",
   "main": "dist/index.js",
   "type": "module",