Method validatePath

src/McpContext.ts:207–259

(filePath?: string)

  }

  async validatePath(filePath?: string): Promise<void> {
    if (filePath === undefined) {
      return;
    }
    const roots = this.roots();
    if (roots === undefined) {
      return;
    }

    let canonicalPath: string;

    try {
      canonicalPath = await resolveCanonicalPath(filePath);
    } catch (err) {
      const errMsg = err instanceof Error ? err.message : String(err);
      console.error(
        `[MCP Context] Error resolving real path for ${filePath}: ${errMsg}`,
      );
      throw new Error(
        `Access denied: Cannot resolve base path for ${filePath}.`,
      );
    }

    let allowed = false;
    for (const root of roots) {
      try {
        const rootPathUri = root.uri;
        const rootPath = path.resolve(fileURLToPath(rootPathUri));
        const canonicalRoot = await fsPromises.realpath(rootPath);

        if (
          canonicalPath === canonicalRoot ||
          canonicalPath.startsWith(canonicalRoot + path.sep)
        ) {
          allowed = true;
          break;
        }
      } catch (rootErr) {
        const errMsg =
          rootErr instanceof Error ? rootErr.message : String(rootErr);
        console.warn(
          `[MCP Context] Could not resolve configured root ${root.uri}: ${errMsg}`,
        );
        // Skip this root if it cannot be resolved.
      }
    }

    if (!allowed) {
      throw new Error(
        `Access denied: path ${filePath} (canonical: ${canonicalPath}) is not within any of the configured workspace roots.`,
      );
    }
  }

  resolveCdpRequestId(page: McpPage, cdpRequestId: string): number | undefined {
    if (!cdpRequestId) {