token-goat 2.6.33 → 2.6.35

package/dist/{token-goat-hook-chunk-EKGDLI4D.mjs → token-goat-hook-chunk-VU6VGZBM.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-hook-chunk-VDXQXYJK.mjs";
+} from "./token-goat-hook-chunk-NXVT4F3S.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-hook-chunk-UWV4MTYI.mjs";
+} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-hook-chunk-E6AIPKNF.mjs";
+} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";
 
@@ -126,7 +126,19 @@ function forCompare(p) {
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function resolveToolRoot(projectRoot) {
-  return resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+  assertRootAllowed(resolved);
+  return resolved;
+}
+var RootNotAllowedError = class extends Error {
+};
+function assertRootAllowed(resolvedRoot) {
+  const allowedRoots = loadConfig().mcp.allowed_roots;
+  if (allowedRoots.length === 0) return;
+  if (allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) return;
+  throw new RootNotAllowedError(
+    `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`
+  );
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
@@ -150,16 +162,6 @@ function specFilePart(spec) {
 var NO_PINS = /* @__PURE__ */ new Map();
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
-  const allowedRoots = loadConfig().mcp.allowed_roots;
-  if (allowedRoots.length > 0 && !allowedRoots.some((allowed) => checkWithinProjectRoot(resolvedRoot, allowed).inside)) {
-    return {
-      ok: false,
-      refusal: toCallToolResult({
-        text: `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`,
-        code: 1
-      })
-    };
-  }
   const checked = [];
   const pins = /* @__PURE__ */ new Map();
   for (const raw of targets) {