Aditya Rawat 02ea482b37 fix: validate projectPath in MCP handler to block sensitive directories (#230) ...

Validate projectPath in getCodeGraph so MCP clients can't open a codegraph in a
sensitive system directory. Guarded with existsSync so nested/not-yet-created
sub-paths still resolve up to the default project (preserves issue #238). Adds
MCP-handler rejection tests (POSIX + Windows-gated); validated on a real
Windows 11 VM.

Closes #230

2026-05-22 14:15:02 -05:00

22 KiB

Raw Permalink Blame History

View Raw