weavatrix 0.1.0 → 0.1.2

package/src/mcp-server.mjs

@@ -15,15 +15,17 @@
 // go to stderr. Two argv forms:
 //   weavatrix-mcp <repoRoot> [caps]               — graph path derived from the standard layout
 //   weavatrix-mcp <graph.json> <repoRoot> [caps]  — explicit graph file (classic form)
-import {existsSync, statSync} from 'node:fs'
+import {existsSync, statSync, realpathSync} from 'node:fs'
 import {join, dirname} from 'node:path'
 import {fileURLToPath} from 'node:url'
 import process from 'node:process'
 import {loadGraph} from './mcp/graph-context.mjs'
-import {loadHotApi, HOT_FILES} from './mcp/catalog.mjs'
 import {graphOutDirForRepo} from './graph/layout.js'
+import {createRequire} from 'node:module'
 
-const SERVER_INFO = {name: 'weavatrix', version: '0.0.1'}
+// version comes from package.json so serverInfo can never drift from the published package again
+const PKG_VERSION = (() => { try { return createRequire(import.meta.url)('../package.json').version } catch { return '0.0.0' } })()
+const SERVER_INFO = {name: 'weavatrix', version: PKG_VERSION}
 const DEFAULT_PROTOCOL = '2024-11-05'
 const log = (...a) => process.stderr.write(`[weavatrix] ${a.join(' ')}\n`)
 
@@ -31,19 +33,20 @@ const log = (...a) => process.stderr.write(`[weavatrix] ${a.join(' ')}\n`)
 // otherwise it is the graph.json path and the repo root follows it.
 let GRAPH_PATH = process.argv[2]
 let repoArg = process.argv[3]
-// caps ABSENT (undefined) = no per-repo config → ALL tools. PRESENT (even the empty string, which a
-// registration may pass for a zero-capability selection) = explicit set — see catalog.loadHotApi.
+// caps ABSENT (undefined) = offline defaults (including explicit-call repo retargeting, no network).
+// PRESENT (even the empty string) = explicit set — see catalog.loadHotApi.
 let CAPS_ARG = process.argv[4]
 try {
     if (GRAPH_PATH && statSync(GRAPH_PATH).isDirectory()) {
-        repoArg = GRAPH_PATH.replace(/[\\/]+$/, '')
+        repoArg = realpathSync.native(GRAPH_PATH)
         CAPS_ARG = process.argv[3]
         GRAPH_PATH = join(graphOutDirForRepo(repoArg), 'graph.json')
-        if (!existsSync(GRAPH_PATH)) log(`no graph built yet for ${repoArg} — ask the agent to call rebuild_graph (or open_repo) once; it builds into the standard weavatrix-graphs layout`)
+        if (!existsSync(GRAPH_PATH)) log(`no graph built yet for ${repoArg} — ask the agent to call rebuild_graph; it builds into the standard weavatrix-graphs layout`)
     }
 } catch { /* argv[2] is not a directory → classic <graph.json> <repoRoot> form */ }
 // repo source root for search_code / read_source; null → those tools degrade.
-const REPO_ROOT = repoArg && existsSync(repoArg) ? repoArg : null
+let REPO_ROOT = null
+try { if (repoArg && statSync(repoArg).isDirectory()) REPO_ROOT = realpathSync.native(repoArg) } catch { /* invalid repo root */ }
 
 // ---- hot reload of tool implementations -----------------------------------------------------------
 // Node caches modules at spawn, so edits to the tool code would otherwise be invisible until the MCP
@@ -52,16 +55,19 @@ const REPO_ROOT = repoArg && existsSync(repoArg) ? repoArg : null
 // swap the tool table, then notify the client. The stdio shell, graph-context (its caches), and the
 // analysis engines are NOT swapped — changing those still needs a reconnect.
 const MCP_DIR = join(dirname(fileURLToPath(import.meta.url)), 'mcp')
-function hotVersion() {
+const CATALOG_URL = new URL('./mcp/catalog.mjs', import.meta.url)
+const loadCatalog = (version = 0) => import(version ? `${CATALOG_URL.href}?v=${version}` : CATALOG_URL.href)
+function hotVersion(hotFiles) {
     let v = 0
-    for (const f of HOT_FILES) {
+    for (const f of hotFiles) {
         try { const t = statSync(join(MCP_DIR, f)).mtimeMs; if (t > v) v = t } catch { /* missing file just doesn't bump the version */ }
     }
     return v
 }
 
 async function main() {
-    let api = await loadHotApi(0, CAPS_ARG)
+    let catalog = await loadCatalog()
+    let api = await catalog.loadHotApi(0, CAPS_ARG)
     let graph = null
     let graphError = null
     // ctx owns the CURRENT target: rebuild_graph reloads it, open_repo retargets graphPath/repoRoot
@@ -78,20 +84,23 @@ async function main() {
         log(`failed to load graph: ${e.message}`)
     }
     log(`repo root: ${REPO_ROOT || '(none — source/action tools disabled)'}`)
-    log(`capabilities: ${api.caps ? [...api.caps].join(',') : 'all'} (${api.tools.length} tools)`)
+    log(`capabilities: ${[...api.caps].join(',') || '(none)'} (${api.tools.length} tools)`)
 
     let protocolVersion = DEFAULT_PROTOCOL
     const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n')
     const reply = (id, result) => send({jsonrpc: '2.0', id, result})
     const fail = (id, code, message) => send({jsonrpc: '2.0', id, error: {code, message}})
 
-    let loadedVersion = hotVersion()
+    let loadedVersion = hotVersion(catalog.HOT_FILES)
     let lastFailedVersion = 0
     const maybeHotReload = async () => {
-        const v = hotVersion()
+        const v = hotVersion(catalog.HOT_FILES)
         if (v <= loadedVersion || v === lastFailedVersion) return
         try {
-            api = await loadHotApi(v, CAPS_ARG)
+            const nextCatalog = await loadCatalog(v)
+            const nextApi = await nextCatalog.loadHotApi(v, CAPS_ARG)
+            catalog = nextCatalog
+            api = nextApi
             loadedVersion = v
             log(`hot-reloaded tool implementations from changed source (${api.tools.length} tools)`)
             send({jsonrpc: '2.0', method: 'notifications/tools/list_changed'})
@@ -118,8 +127,8 @@ async function main() {
             await maybeHotReload()
             const tool = api.byName.get(params?.name)
             if (!tool) return reply(id, {content: [{type: 'text', text: `Unknown tool: ${params?.name}`}], isError: true})
-            // action tools (rebuild_graph) don't need a currently-loaded graph; read tools do
-            if (!graph && tool.cap !== 'build') return reply(id, {content: [{type: 'text', text: `Graph unavailable: ${graphError}`}], isError: true})
+            // action tools can establish/retarget a graph; read tools need one already loaded
+            if (!graph && tool.cap !== 'build' && tool.cap !== 'retarget') return reply(id, {content: [{type: 'text', text: `Graph unavailable: ${graphError}`}], isError: true})
             try {
                 let text = String(await tool.run(graph, params?.arguments || {}, ctx))
                 // Graph answers silently reflect a point-in-time build — surface staleness on every graph tool.

package/src/mcp-source-tools.mjs

@@ -1,10 +1,14 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
 import { extname, join, relative } from 'node:path'
+import { resolveRepoPath } from './repo-path.js'
+import { childProcessEnv } from './child-env.js'
 
 const SEARCH_SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'out', '.next', 'coverage', 'vendor', '.venv', 'venv', 'env', 'target', '__pycache__', '.idea', '.vscode', '.cache', 'bin', 'obj', 'weavatrix-graphs'])
 const BINARY_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.pdf', '.zip', '.gz', '.tar', '.exe', '.dll', '.so', '.dylib', '.woff', '.woff2', '.ttf', '.eot', '.mp4', '.mp3', '.wasm', '.class', '.jar', '.node', '.bin'])
 const MAX_SEARCH_FILE_BYTES = 1024 * 1024
+const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024
+const MAX_SOURCE_CONTEXT_LINES = 1000
 
 function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }) {
     const rg = resolveRg()
@@ -13,7 +17,7 @@ function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }) {
     if (!isRegex) args.push('--fixed-strings')
     if (glob) args.push('-g', glob)
     args.push('--', query, repoRoot)
-    const res = spawnSync(rg, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000 })
+    const res = spawnSync(rg, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
     if (res.status !== 0 && res.status !== 1) return null
     const out = []
     for (const line of (res.stdout || '').split(/\r?\n/)) {
@@ -122,14 +126,21 @@ export function readSource({ repoRoot, resolveNode, isSymbol }, g, { label, path
     }
     // explicit anchor wins: window = start_line-before .. start_line+after (how a path read escapes the file head)
     if (start_line != null && Number(start_line) > 0) focusLine = Math.floor(Number(start_line))
-    const abs = join(repoRoot, file)
-    if (!existsSync(abs)) return `File not found: ${file}`
+    const resolved = resolveRepoPath(repoRoot, file)
+    if (resolved.reason === 'escape') return `Refusing to read "${file}": path escapes the repository root.`
+    if (resolved.reason === 'not-found') return `File not found: ${file}`
+    if (!resolved.ok) return `Could not resolve ${file} inside the repository root.`
+    const abs = resolved.path
+    let st
+    try { st = statSync(abs) } catch (e) { return `Could not inspect ${file}: ${e.message}` }
+    if (!st.isFile()) return `Could not read ${file}: not a regular file.`
+    if (st.size > MAX_SOURCE_FILE_BYTES) return `Could not read ${file}: file exceeds the ${MAX_SOURCE_FILE_BYTES / 1024 / 1024} MB source-read limit.`
     let text
     try { text = readFileSync(abs, 'utf8') } catch (e) { return `Could not read ${file}: ${e.message}` }
     const lines = text.split(/\r?\n/)
     if (focusLine) focusLine = Math.min(focusLine, lines.length) // an anchor past EOF shows the tail, not nothing
-    const b = Math.max(0, Number(before) || 0)
-    const a = Math.max(1, Number(after) || 40)
+    const b = Math.min(MAX_SOURCE_CONTEXT_LINES, Math.max(0, Number(before) || 0))
+    const a = Math.min(MAX_SOURCE_CONTEXT_LINES, Math.max(1, Number(after) || 40))
     const start = focusLine ? Math.max(1, focusLine - b) : 1
     const end = focusLine ? Math.min(lines.length, focusLine + a) : Math.min(lines.length, 1 + b + a)
     const width = String(end).length

package/src/process.js

@@ -1,5 +1,6 @@
 // Subprocess runner shared by the search engines and security sweeps.
 import { spawn } from "node:child_process";
+import { childProcessEnv } from "./child-env.js";
 
 // Windows: .cmd/.ps1 shims (npx, etc.) can't be spawned directly by Node — they need a
 // shell. With shell:true Node does NOT quote args, so we build a quoted command line ourselves
@@ -18,13 +19,13 @@ export function runCommand(command, args = [], options = {}) {
     const child = needsShell
       ? spawn([command, ...args].map(winQuote).join(" "), [], {
           cwd: options.cwd || undefined,
-          env: { ...process.env, ...(options.env || {}) },
+          env: childProcessEnv(options.env || {}),
           shell: true,
           windowsHide: true
         })
       : spawn(command, args, {
           cwd: options.cwd || undefined,
-          env: { ...process.env, ...(options.env || {}) },
+          env: childProcessEnv(options.env || {}),
           windowsHide: true
         });
 
@@ -46,7 +47,7 @@ export function runCommand(command, args = [], options = {}) {
     const killTree = () => {
       if (process.platform === "win32" && child.pid) {
         try {
-          spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true });
+          spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true, env: childProcessEnv() });
         } catch {
           try { child.kill(); } catch { /* process may already be gone */ }
         }

package/src/repo-path.js

@@ -0,0 +1,53 @@
+import { realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+export function isPathInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+// Cache the canonical root for callers that resolve many graph-derived paths.
+export function createRepoBoundary(repoRoot) {
+  let root;
+  let rootError;
+  try {
+    root = realpathSync.native(repoRoot);
+  } catch (error) {
+    rootError = error;
+  }
+
+  return {
+    root,
+    resolve(candidate) {
+      if (!root) return { ok: false, reason: "invalid-root", error: rootError };
+      const input = String(candidate ?? "");
+      if (!input || input.includes("\0")) return { ok: false, reason: "invalid-path" };
+      if (isAbsolute(input)) return { ok: false, reason: "escape" };
+
+      let lexical;
+      try {
+        lexical = resolve(root, input);
+      } catch (error) {
+        return { ok: false, reason: "invalid-path", error };
+      }
+      if (!isPathInside(root, lexical)) return { ok: false, reason: "escape" };
+
+      let target;
+      try {
+        target = realpathSync.native(lexical);
+      } catch (error) {
+        return { ok: false, reason: error?.code === "ENOENT" ? "not-found" : "unreadable", error };
+      }
+      if (!isPathInside(root, target)) return { ok: false, reason: "escape" };
+
+      return { ok: true, path: target };
+    },
+  };
+}
+
+// Resolve one existing repo-relative path without allowing lexical traversal or
+// symlink/junction escapes. Callers get a reason instead of an exception so MCP
+// tools can refuse the read without exposing host filesystem details.
+export function resolveRepoPath(repoRoot, candidate) {
+  return createRepoBoundary(repoRoot).resolve(candidate);
+}

package/src/security/installed.js

@@ -2,10 +2,11 @@
 // (package-lock v1/v2/v3, basic yarn.lock, requirements.txt ==pins, go.sum), plus a top-level
 // node_modules walk — which also yields the lockfile-DRIFT signal (installed ≠ locked → tampering or
 // stale install). Parsers are pure + exported for tests; collectInstalled is the thin fs wrapper.
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
 import { uniqueBy } from "../util.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 const pep503 = (name) => String(name).toLowerCase().replace(/[-_.]+/g, "-"); // PyPI canonical name
 
@@ -144,21 +145,19 @@ export function parseGoModPackages(text) {
 }
 
 // Top-level node_modules walk (incl. @scopes): the ground truth of what is REALLY on disk.
-function walkNodeModules(repoPath) {
+function walkNodeModules(repoPath, { readJsonFile = readJson, readdir = readdirSync } = {}) {
   const out = [];
   const nm = join(repoPath, "node_modules");
   const readPkg = (dir, name) => {
-    try {
-      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      if (pj && pj.version) out.push({ ecosystem: "npm", name: pj.name || name, version: pj.version, dev: false, integrity: "", source: "node_modules" });
-    } catch { /* not a package dir */ }
+    const pj = readJsonFile(join(dir, "package.json"));
+    if (pj && pj.version) out.push({ ecosystem: "npm", name: pj.name || name, version: pj.version, dev: false, integrity: "", source: "node_modules" });
   };
   let entries;
-  try { entries = readdirSync(nm); } catch { return out; }
+  try { entries = readdir(nm); } catch { return out; }
   for (const e of entries) {
     if (e.startsWith(".")) continue;
     if (e.startsWith("@")) {
-      let scoped; try { scoped = readdirSync(join(nm, e)); } catch { continue; }
+      let scoped; try { scoped = readdir(join(nm, e)); } catch { continue; }
       for (const s of scoped) readPkg(join(nm, e, s), `${e}/${s}`);
     } else readPkg(join(nm, e), e);
   }
@@ -170,58 +169,72 @@ const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } ca
 
 const SUBPROJECT_SKIP = new Set([".git", ".idea", ".vscode", ".venv", "venv", "env", "node_modules", "vendor", "dist", "build", "coverage", "__pycache__", ".tox", "testdata"]);
 
-function projectDirs(repoPath) {
-  const dirs = [repoPath];
+function projectDirs(boundary) {
+  const dirs = boundary.root ? [boundary.root] : [];
   let entries = [];
-  try { entries = readdirSync(repoPath, { withFileTypes: true }); } catch { return dirs; }
+  try { entries = readdirSync(boundary.root, { withFileTypes: true }); } catch { return dirs; }
   for (const e of entries) {
     if (!e.isDirectory() || e.name.startsWith(".") || SUBPROJECT_SKIP.has(e.name)) continue;
-    dirs.push(join(repoPath, e.name));
+    const resolved = boundary.resolve(e.name);
+    if (resolved.ok) dirs.push(resolved.path);
     if (dirs.length >= 101) break;
   }
   return dirs;
 }
 
-function collectReqFiles(dir) {
+function collectReqFiles(dir, readdir = readdirSync) {
   const reqFiles = [];
-  try { for (const n of readdirSync(dir)) if (/^requirements[\w.-]*\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, n)); } catch { /* unreadable root */ }
-  try { for (const n of readdirSync(join(dir, "requirements"))) if (/\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, "requirements", n)); } catch { /* no requirements/ dir */ }
+  try { for (const n of readdir(dir)) if (/^requirements[\w.-]*\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, n)); } catch { /* unreadable root */ }
+  try { for (const n of readdir(join(dir, "requirements"))) if (/\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, "requirements", n)); } catch { /* no requirements/ dir */ }
   return reqFiles;
 }
 
 // → { installed: [{ecosystem,name,version,dev,source}], drift: [{name, locked, installed}] }
 export function collectInstalled(repoPath) {
-  const dirs = projectDirs(repoPath);
+  const boundary = createRepoBoundary(repoPath);
+  if (!boundary.root) return { installed: [], drift: [] };
+  const inside = (path) => boundary.resolve(relative(boundary.root, path) || ".");
+  const boundedText = (path) => { const resolved = inside(path); return resolved.ok ? readText(resolved.path) : null; };
+  const boundedJson = (path) => { const resolved = inside(path); return resolved.ok ? readJson(resolved.path) : null; };
+  const boundedReaddir = (path, options) => {
+    const resolved = inside(path);
+    if (!resolved.ok) throw new Error("path is outside the repository");
+    return readdirSync(resolved.path, options);
+  };
+  const dirs = projectDirs(boundary);
   const lock = [];
   const yarn = [];
   const disk = [];
   for (const dir of dirs) {
-    const lockHere = parsePackageLock(readJson(join(dir, "package-lock.json")) || {});
+    const lockHere = parsePackageLock(boundedJson(join(dir, "package-lock.json")) || {});
     lock.push(...lockHere);
-    if (!lockHere.length) yarn.push(...parseYarnLock(readText(join(dir, "yarn.lock")) || ""));
-    disk.push(...walkNodeModules(dir));
+    if (!lockHere.length) yarn.push(...parseYarnLock(boundedText(join(dir, "yarn.lock")) || ""));
+    disk.push(...walkNodeModules(dir, { readJsonFile: boundedJson, readdir: boundedReaddir }));
   }
   // Python: venv site-packages = the ground truth (exact installed versions); requirements*.txt (root +
   // a requirements/ dir) and poetry/uv/Pipfile locks fill in when there's no venv. venv wins per name.
-  const venvPy = dirs.flatMap((dir) => collectVenvPackages(dir));
-  const reqFiles = dirs.flatMap((dir) => collectReqFiles(dir));
+  const venvPy = dirs.flatMap((dir) => collectVenvPackages(dir, { readdir: boundedReaddir }));
+  const reqFiles = dirs.flatMap((dir) => collectReqFiles(dir, boundedReaddir));
   const venvNames = new Set(venvPy.map((p) => p.name));
   const pyDeclared = [
-    ...reqFiles.flatMap((f) => parseRequirements(readText(f) || "")),
-    ...dirs.flatMap((dir) => parseTomlLockPackages(readText(join(dir, "poetry.lock")) || "", "poetry-lock")),
-    ...dirs.flatMap((dir) => parseTomlLockPackages(readText(join(dir, "uv.lock")) || "", "uv-lock")),
-    ...dirs.flatMap((dir) => parsePipfileLock(readJson(join(dir, "Pipfile.lock")) || null)),
+    ...reqFiles.flatMap((f) => parseRequirements(boundedText(f) || "")),
+    ...dirs.flatMap((dir) => parseTomlLockPackages(boundedText(join(dir, "poetry.lock")) || "", "poetry-lock")),
+    ...dirs.flatMap((dir) => parseTomlLockPackages(boundedText(join(dir, "uv.lock")) || "", "uv-lock")),
+    ...dirs.flatMap((dir) => parsePipfileLock(boundedJson(join(dir, "Pipfile.lock")) || null)),
   ].filter((p) => !venvNames.has(p.name)); // installed version supersedes the declared pin
   const py = [...venvPy, ...pyDeclared];
   // Go: go.sum (exact, hashed) first, then go.mod require versions as a fallback. Walk the repo root
   // AND its immediate subdirectories so a Go MONOREPO (per-folder modules, no root go.mod — e.g. gpro)
   // still scans; dedupe() collapses the go.sum/go.mod overlap and cross-module shared deps.
-  const goFromDir = (dir) => [...parseGoSum(readText(join(dir, "go.sum")) || ""), ...parseGoModPackages(readText(join(dir, "go.mod")) || "")];
-  const go = [...goFromDir(repoPath)];
-  if (!go.length || existsSync(join(repoPath, "go.work"))) {
+  const goFromDir = (dir) => [...parseGoSum(boundedText(join(dir, "go.sum")) || ""), ...parseGoModPackages(boundedText(join(dir, "go.mod")) || "")];
+  const go = [...goFromDir(boundary.root)];
+  if (!go.length || boundary.resolve("go.work").ok) {
     let subs = [];
-    try { subs = readdirSync(repoPath, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "vendor", "dist", "build", "testdata"].includes(e.name)); } catch { /* unreadable root */ }
-    for (const s of subs.slice(0, 100)) go.push(...goFromDir(join(repoPath, s.name)));
+    try { subs = boundedReaddir(boundary.root, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "vendor", "dist", "build", "testdata"].includes(e.name)); } catch { /* unreadable root */ }
+    for (const s of subs.slice(0, 100)) {
+      const resolved = boundary.resolve(s.name);
+      if (resolved.ok) go.push(...goFromDir(resolved.path));
+    }
   }
 
   // lockfile wins as the version source; disk fills gaps + powers the drift signal. A package