token-goat 2.9.10 → 2.9.11

package/dist/{token-goat-chunk-DCYHAUW3.mjs → token-goat-chunk-3ZALKJ23.mjs}

@@ -25,7 +25,8 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-chunk-YFXFUG3L.mjs";
+} from "./token-goat-chunk-LKOYKSID.mjs";
+import "./token-goat-chunk-2ZUPQYLO.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,22 +35,26 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-chunk-PA5UXNOT.mjs";
+} from "./token-goat-chunk-SY7WTZMW.mjs";
 import {
-  ENV_KEYS,
-  VERSION,
-  dataDir,
   envStrList,
-  extractErrorMessage,
   getDb,
-  globalDbPath,
   loadConfig,
-  normalizePath,
   recordStat,
   resolveProjectRoot,
   savedTokensFromBytes
-} from "./token-goat-chunk-VCEK77ED.mjs";
+} from "./token-goat-chunk-AAEYU2U2.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
+import {
+  ENV_KEYS,
+  VERSION,
+  dataDir,
+  displaySafeJson,
+  extractErrorMessage,
+  foldCaseForContainment,
+  globalDbPath,
+  normalizePath
+} from "./token-goat-chunk-YCKCFYTM.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -121,15 +126,16 @@ function toCallToolResultFromExitCode(fn) {
   const { code, text } = captureOutput(fn);
   return toCallToolResult({ text, code });
 }
-function realPathOrSelf(p) {
+function realPathForContainment(p) {
   try {
     return fs.realpathSync.native(p);
-  } catch {
-    return p;
+  } catch (err) {
+    const code = err.code;
+    return code === "ENOENT" || code === "ENOTDIR" ? p : null;
   }
 }
 function forCompare(p) {
-  return process.platform === "win32" ? p.toLowerCase() : p;
+  return process.platform === "win32" ? foldCaseForContainment(p) : p;
 }
 function resolveToolRoot(projectRoot) {
   const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
@@ -146,18 +152,40 @@ function assertRootAllowed(resolvedRoot) {
     `refused: "${resolvedRoot}" is not inside any root listed in mcp.allowed_roots. A caller-supplied projectRoot is untrusted input, so this deployment pins which roots may be named; add the root to mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to permit it.`
   );
 }
-function checkWithinProjectRoot(target, resolvedRoot) {
-  const root = forCompare(normalizePath(realPathOrSelf(resolvedRoot)));
-  const abs = path.resolve(resolvedRoot, normalizePath(target));
-  let identity;
+var NO_CHECK_PINS = [];
+function identityOf(p) {
   try {
-    identity = fileIdentity(fs.statSync(abs, { bigint: true }));
+    return fileIdentity(fs.statSync(p, { bigint: true }));
   } catch {
-    identity = null;
+    return null;
   }
-  const realNative = realPathOrSelf(abs);
-  const real = forCompare(normalizePath(realNative));
-  return { inside: real === root || real.startsWith(root.endsWith("/") ? root : root + "/"), abs, real: realNative, identity };
+}
+function pinsFor(abs, real, identity) {
+  const pinIdentity = identity ?? ABSENT_PIN;
+  return [
+    [pinKey(abs), pinIdentity],
+    [pinKey(real), pinIdentity]
+  ];
+}
+function checkWithinProjectRoot(target, resolvedRoot) {
+  const rootReal = realPathForContainment(resolvedRoot);
+  const abs = path.resolve(resolvedRoot, normalizePath(target));
+  const absRaw = path.resolve(resolvedRoot, target);
+  const identity = identityOf(absRaw);
+  const realNative = realPathForContainment(abs);
+  if (rootReal === null) return { inside: false, reason: "unresolvable-root", pins: NO_CHECK_PINS };
+  if (realNative === null) return { inside: false, reason: "unresolvable-target", pins: NO_CHECK_PINS };
+  const root = forCompare(normalizePath(rootReal));
+  const under = (real) => {
+    const r = forCompare(normalizePath(real));
+    return r === root || r.startsWith(root.endsWith("/") ? root : root + "/");
+  };
+  if (!under(realNative)) return { inside: false, reason: "outside", pins: NO_CHECK_PINS };
+  if (absRaw === abs) return { inside: true, reason: "inside", pins: pinsFor(abs, realNative, identity) };
+  const realRaw = realPathForContainment(absRaw);
+  if (realRaw === null) return { inside: false, reason: "unresolvable-target", pins: NO_CHECK_PINS };
+  if (!under(realRaw)) return { inside: false, reason: "outside", pins: NO_CHECK_PINS };
+  return { inside: true, reason: "inside", pins: [...pinsFor(abs, realNative, identity), ...pinsFor(absRaw, realRaw, identity)] };
 }
 function specFilePart(spec) {
   const range = parseLineRange(spec);
@@ -166,6 +194,17 @@ function specFilePart(spec) {
   return colonIdx === -1 ? spec : spec.slice(0, colonIdx);
 }
 var NO_PINS = /* @__PURE__ */ new Map();
+function refusalText(file, resolvedRoot, reason) {
+  const escapeHatch = "Set mcp.confine_reads_to_project_root = false (or TOKEN_GOAT_MCP_CONFINE_READS=0) to allow cross-root reads.";
+  if (reason === "unresolvable-root") {
+    return `refused: the project root "${resolvedRoot}" could not be resolved, so no path can be confirmed to sit inside it. This is a broken workspace root -- an unmounted share, a deleted directory, or a permission change on a parent -- not a request to read outside the project.`;
+  }
+  if (reason === "unresolvable-target") {
+    return `refused: "${file}" could not be resolved to a real location, so it cannot be confirmed to sit inside the project root. A symlink loop, a permission error on a parent directory, or a path past the operating system's length limit all produce this. The check fails closed rather than falling back to comparing the text of the path.`;
+  }
+  const rootScope = loadConfig().mcp.allowed_roots.length === 0 ? "Each call is confined to the projectRoot it names, and that root comes from the caller: set mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to pin which roots may be named at all." : "Each call is confined to the projectRoot it names, which must itself sit inside mcp.allowed_roots.";
+  return `refused: "${file}" is outside the project root "${resolvedRoot}". ${rootScope} ${escapeHatch}`;
+}
 function confineTargets(targets, resolvedRoot, splitCommas = true) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
   const checked = [];
@@ -177,17 +216,9 @@ function confineTargets(targets, resolvedRoot, splitCommas = true) {
       if (file === "") continue;
       const check = checkWithinProjectRoot(file, resolvedRoot);
       if (!check.inside) {
-        return {
-          ok: false,
-          refusal: toCallToolResult({
-            text: `refused: "${file}" is outside the project root. The MCP tools are confined to the workspace. Set mcp.confine_reads_to_project_root = false (or TOKEN_GOAT_MCP_CONFINE_READS=0) to allow cross-root reads.`,
-            code: 1
-          })
-        };
+        return { ok: false, refusal: toCallToolResult({ text: refusalText(file, resolvedRoot, check.reason), code: 1 }) };
       }
-      const pinIdentity = check.identity ?? ABSENT_PIN;
-      pins.set(pinKey(check.abs), pinIdentity);
-      pins.set(pinKey(check.real), pinIdentity);
+      for (const [key, identity] of check.pins) pins.set(key, identity);
     }
     checked.push(splitCommas ? parts.join(",") : parts[0]);
   }
@@ -211,7 +242,7 @@ function mcpToolAllowlist() {
   return names.length === 0 ? null : new Set(names);
 }
 async function createMcpServer() {
-  const [{ McpServer }, { z }] = await Promise.all([import("./token-goat-chunk-LYWIRYCF.mjs"), import("./token-goat-chunk-PXWBHSFB.mjs")]);
+  const [{ McpServer }, { z }] = await Promise.all([import("./token-goat-chunk-LHLQFGWQ.mjs"), import("./token-goat-chunk-T6M7DAW3.mjs")]);
   const server = new McpServer({ name: "token-goat", version: VERSION });
   const allowlist = mcpToolAllowlist();
   if (allowlist !== null) {
@@ -473,7 +504,7 @@ async function createMcpServer() {
         embeddingsEnabled,
         embeddingsAvailable
       };
-      return toCallToolResult({ text: JSON.stringify(status, null, 2), code: 0 });
+      return toCallToolResult({ text: displaySafeJson(status), code: 0 });
     }
   );
   server.registerTool(
@@ -678,7 +709,7 @@ async function createMcpServer() {
         text: z.string().max(CONTENT_MAX_INPUT_CHARS).describe("text to compress")
       }
     },
-    (args) => toCallToolResult({ text: JSON.stringify(compressionPayload(compressText(args.text)), null, 2), code: 0 })
+    (args) => toCallToolResult({ text: displaySafeJson(compressionPayload(compressText(args.text))), code: 0 })
   );
   server.registerTool(
     "retrieve_text",
@@ -704,7 +735,7 @@ async function createMcpServer() {
       }
     },
     (args) => toCallToolResult({
-      text: JSON.stringify(createHandoff(args.name, args.text, resolveToolRoot(args.projectRoot)), null, 2),
+      text: displaySafeJson(createHandoff(args.name, args.text, resolveToolRoot(args.projectRoot))),
       code: 0
     })
   );
@@ -723,12 +754,13 @@ async function createMcpServer() {
         projectRoot: resolveToolRoot(args.projectRoot),
         ...args.full === true ? { full: true } : {}
       });
-      return result === null ? toCallToolResult({ text: `no local handoff named "${args.name}" in this project`, code: 1 }) : typeof result === "string" ? toRawCallToolResult({ text: result, code: 0 }) : toCallToolResult({ text: JSON.stringify(compressionPayload(result), null, 2), code: 0 });
+      return result === null ? toCallToolResult({ text: `no local handoff named "${args.name}" in this project`, code: 1 }) : typeof result === "string" ? toRawCallToolResult({ text: result, code: 0 }) : toCallToolResult({ text: displaySafeJson(compressionPayload(result)), code: 0 });
     }
   );
   return server;
 }
 export {
+  checkWithinProjectRoot,
   createMcpServer,
   mcpToolAllowlist
 };

package/dist/{token-goat-chunk-JS44SRAX.mjs → token-goat-chunk-4NZUXC4F.mjs}

@@ -3,7 +3,7 @@ const require = __cjsRequire(import.meta.url);
 import {
   deliveredOutputBytes,
   wrappedShell
-} from "./token-goat-chunk-ATVQ6IIT.mjs";
+} from "./token-goat-chunk-FDURVZQD.mjs";
 import {
   ToolFilter,
   capTokens,
@@ -15,8 +15,9 @@ import {
   recordStat,
   selectFilter,
   shlexSplit
-} from "./token-goat-chunk-VCEK77ED.mjs";
+} from "./token-goat-chunk-AAEYU2U2.mjs";
 import "./token-goat-chunk-EEIDFMEM.mjs";
+import "./token-goat-chunk-YCKCFYTM.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";