filesystem.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include <entropic/mcp/servers/filesystem.h>
#include <entropic/mcp/tool_base.h>
#include <entropic/mcp/server_base.h>
#include <entropic/types/logging.h>
#include <entropic/types/run_scope.h>
 
#include <nlohmann/json.hpp>
 
#include <algorithm>
#include <cstring>
#include <filesystem>
#include <fstream>
#include <functional>
#include <optional>
#include <regex>
#include <sstream>
 
namespace fs = std::filesystem;
using json = nlohmann::json;
 
static auto logger = entropic::log::get("mcp.filesystem");
 
namespace entropic {
 
// ── FileAccessTracker ────────────────────────────────────
 
void FileAccessTracker::record_read(const std::string& session,
                                    const std::string& path,
                                    size_t hash) {
    reads_.with(session, [&](auto& reads) { reads[path] = hash; });
    logger->info("Tracked read: session='{}' {}", session, path);
}
 
 
bool FileAccessTracker::was_read(const std::string& session,
                                 const std::string& path) const {
    return reads_.peek(session, [&](const auto* reads) {
        return reads != nullptr && reads->count(path) > 0;
    });
}
 
bool FileAccessTracker::release_session(const std::string& session) {
    return reads_.release(session);
}
 
std::size_t FileAccessTracker::session_count() const {
    return reads_.session_count();
}
 
// ── File-local helpers ───────────────────────────────────
 
namespace {
 
bool should_skip_dir(const std::string& name) {
    return IgnoreMatcher::is_skipped_dir_name(name);
}
 
bool path_within(const fs::path& path, const fs::path& base) {
    fs::path rel = path.lexically_relative(base);
    return !rel.empty()
        && *rel.begin() != fs::path("..")
        && rel != fs::path("..");
}
 
fs::path canonical_entry(const fs::path& entry) {
    std::error_code ec;
    auto c = fs::weakly_canonical(entry, ec);
    return ec ? entry.lexically_normal() : c;
}
 
std::optional<fs::path> first_containing(
    const std::vector<fs::path>& entries, const fs::path& resolved) {
    std::optional<fs::path> hit;
    for (const auto& e : entries) {
        auto base = canonical_entry(e);
        if (path_within(resolved, base)) {
            hit = base;
            break;
        }
    }
    return hit;
}
 
const char* outside_root_mode_name(OutsideRootAccess mode) {
    const char* name = "optional";
    if (mode == OutsideRootAccess::refuse) { name = "false"; }
    if (mode == OutsideRootAccess::allow) { name = "true"; }
    return name;
}
 
const char* access_verb(PathAccess access) {
    return access == PathAccess::write ? "write" : "read";
}
 
std::string outside_root_refusal(OutsideRootVerdict verdict,
                                 const OutsideRootRequest& req) {
    std::string head = "Path escapes project root: " + req.path
        + " (root: " + req.root + ")";
    if (verdict == OutsideRootVerdict::rejected) {
        return "outside_root_rejected: " + head + " — the host's path "
               "approver refused this " + access_verb(req.access) + ".";
    }
    return "outside_root_approval_required: " + head + " — "
        + access_verb(req.access) + " access outside the project root "
        "needs approval (mcp.filesystem.allow_outside_root: optional) and "
        "no path approver is registered, so it is refused. Pre-approve "
        "the directory with mcp.filesystem.outside_root_allow, set "
        "allow_outside_root: true, or register an approver with "
        "entropic_set_path_approval_callback.";
}
 
[[noreturn]] void refuse_denied(const fs::path& resolved,
                                const fs::path& entry, PathAccess access,
                                const fs::path& root) {
    logger->error("Path escape blocked by outside_root_deny: {} {} "
                  "(entry: {}, root: {})", access_verb(access),
                  resolved.string(), entry.string(), root.string());
    throw std::runtime_error(
        "outside_root_denied: " + resolved.string() + " is under "
        "mcp.filesystem.outside_root_deny entry " + entry.string()
        + " — refused regardless of allow_outside_root.");
}
 
[[noreturn]] void refuse_escape(const fs::path& resolved,
                                const fs::path& root) {
    logger->error("Path escape blocked: {} (root: {})",
                  resolved.string(), root.string());
    throw std::runtime_error(
        "Path escapes project root: " + resolved.string());
}
 
void log_outside_root_served(const fs::path& resolved, PathAccess access,
                             const std::optional<fs::path>& allowed_by) {
    std::string why = allowed_by.has_value()
        ? "outside_root_allow entry " + allowed_by->string()
        : std::string("allow_outside_root: true");
    logger->info("Outside-root {} served ({}): {}", access_verb(access),
                 why, resolved.string());
}
 
std::string join_paths(const std::vector<fs::path>& paths) {
    std::string s;
    for (const auto& p : paths) {
        s += (s.empty() ? "" : ", ") + p.string();
    }
    return "[" + s + "]";
}
 
void warn_deny_entries_inside_root(const std::vector<fs::path>& deny,
                                   const fs::path& root) {
    for (const auto& e : deny) {
        if (path_within(canonical_entry(e), root)) {
            logger->warn("outside_root_deny entry {} is INSIDE the root {} "
                         "— the outside-root lists govern paths outside "
                         "the root only, so it has no effect there",
                         e.string(), root.string());
        }
    }
}
 
struct WalkBudget {
    int max_entries = 0;   
    long visited = 0;      
    bool truncated = false; 
};
 
bool walk_budget_spent(WalkBudget& budget) {
    ++budget.visited;
    bool spent = budget.max_entries > 0
        && budget.visited >= static_cast<long>(budget.max_entries);
    if (spent) { budget.truncated = true; }
    return spent;
}
 
 
 
 
std::string read_file_contents(const fs::path& path) {
    std::ifstream in(path, std::ios::binary);
    if (!in.is_open()) {
        throw std::runtime_error(
            "Cannot open file: " + path.string());
    }
    std::ostringstream ss;
    ss << in.rdbuf();
    return ss.str();
}
 
void write_file_contents(const fs::path& path,
                         const std::string& content) {
    fs::create_directories(path.parent_path());
    std::ofstream out(path, std::ios::binary | std::ios::trunc);
    if (!out.is_open()) {
        throw std::runtime_error(
            "Cannot write file: " + path.string());
    }
    out << content;
}
 
size_t hash_content(const std::string& s) {
    return std::hash<std::string>{}(s);
}
 
std::string make_error(const std::string& code,
                       const std::string& message) {
    json j;
    j["error"] = code;
    j["message"] = message;
    return j.dump();
}
 
struct Page {
    long offset = 0; 
    long limit = 0;  
};
 
std::string read_page(const json& args, long default_limit, long max_limit,
                      Page& page) {
    page.offset = args.value<long>("offset", 0);
    page.limit = args.value("limit", default_limit);
    std::string err;
    // Written with '>' only: knots v1.4.3 reads a bare '<' here as a
    // template bracket and loses the function boundary.
    if (0 > page.offset || 1 > page.limit || page.limit > max_limit) {
        err = make_error("invalid_args",
            "offset must be >= 0 and limit 1.." + std::to_string(max_limit)
            + " (got offset " + std::to_string(page.offset) + ", limit "
            + std::to_string(page.limit) + ")");
    }
    return err;
}
 
class PagedResult {
public:
    explicit PagedResult(Page page) : page_(page) {}
 
    bool offer(json item) {
        bool keep_going = true;
        if (page_.offset > seen_) {
            ++seen_;
        } else if (static_cast<long>(items_.size()) >= page_.limit) {
            more_ = true;
            keep_going = false;
        } else {
            items_.push_back(std::move(item));
        }
        return keep_going;
    }
 
    bool full() const { return more_; }
 
    void finish(json& result, const std::string& key,
                bool walk_truncated) {
        const long returned = static_cast<long>(items_.size());
        result[key] = std::move(items_);
        result["truncated"] = more_ || walk_truncated;
        if (more_) {
            result["reason"] = "limit";
            result["next_offset"] = page_.offset + returned;
        } else if (walk_truncated) {
            result["reason"] = "walk";
        }
    }
 
private:
    Page page_;
    long seen_ = 0;
    bool more_ = false;
    json items_ = json::array(); 
};
 
std::string display_path(const fs::path& root, const fs::path& path) {
    return path_within(path, root)
        ? path.lexically_relative(root).generic_string()
        : path.string();
}
 
struct ReadWindow {
    long offset = 1; 
    long limit = 0;  
    long budget = 0; 
};
 
struct WindowReader {
    const ReadWindow& w;          
    json lines = json::array();   
    long bytes = 0;               
    bool more = false;            
    std::string err;              
 
    void take(long n, const std::string& line) {
        const long size = static_cast<long>(line.size()) + 1;
        const bool full = (w.limit > 0 && static_cast<long>(lines.size()) >= w.limit)
            || (w.budget > 0 && bytes + size > w.budget);
        if (w.offset > n || more) { return; }
        if (full && lines.empty()) {
            err = make_error("size_exceeded", "Line " + std::to_string(n)
                + " is " + std::to_string(size) + " bytes, more than the "
                "whole read budget (" + std::to_string(w.budget) + ")");
        } else if (full) {
            more = true;
        } else {
            json entry;
            entry["line"] = n;
            entry["content"] = line;
            lines.push_back(std::move(entry));
            bytes += size;
        }
    }
};
 
json read_numbered_lines(const fs::path& path, const std::string& display,
                         const ReadWindow& w, std::string& err) {
    std::ifstream in(path, std::ios::binary);
    WindowReader reader{w};
    std::string line;
    long n = 0;
    while (reader.err.empty() && std::getline(in, line)) {
        reader.take(++n, line);
    }
    err = reader.err;
    json result;
    result["path"] = display;
    result["total"] = n;
    result["offset"] = w.offset;
    result["truncated"] = reader.more;
    if (reader.more) {
        result["next_offset"] = w.offset + static_cast<long>(reader.lines.size());
    }
    result["lines"] = std::move(reader.lines);
    return result;
}
 
void emit_glob_star(const std::string& pat, size_t& i, std::string& out) {
    out += ".*";
    bool dbl = (i + 1 < pat.size()) && (pat[i + 1] == '*');
    if (!dbl) { return; }
    ++i;
    if (i + 1 < pat.size() && pat[i + 1] == '/') { ++i; }
}
 
bool glob_match(const std::string& filename,
                const std::string& pattern) {
    std::string regex_str;
    regex_str.reserve(pattern.size() * 2);
 
    for (size_t i = 0; i < pattern.size(); ++i) {
        char ch = pattern[i];
        if (ch == '*') {
            emit_glob_star(pattern, i, regex_str);
        } else if (ch == '?') {
            regex_str += '.';
        } else if (ch == '.') {
            regex_str += "\\.";
        } else {
            regex_str += ch;
        }
    }
 
    try {
        std::regex re(regex_str, std::regex::icase);
        return std::regex_match(filename, re);
    } catch (const std::regex_error& e) {
        logger->warn(
            "glob_match: malformed pattern '{}' → {} — treated as "
            "non-match", pattern, e.what());
        return false;
    }
}
 
std::vector<std::string> split_brace_alternatives(
    const std::string& body) {
    std::vector<std::string> out;
    std::string current;
    for (char c : body) {
        if (c == ',') {
            out.push_back(std::move(current));
            current.clear();
        } else {
            current += c;
        }
    }
    out.push_back(std::move(current));
    return out;
}
 
std::vector<std::string> multiply_alternatives(
    const std::vector<std::string>& bases,
    const std::vector<std::string>& alternatives) {
    std::vector<std::string> next;
    next.reserve(bases.size() * alternatives.size());
    for (const auto& base : bases) {
        for (const auto& alt : alternatives) {
            next.push_back(base + alt);
        }
    }
    return next;
}
 
std::vector<std::string> expand_braces(const std::string& pattern) {
    std::vector<std::string> out{""};
    size_t i = 0;
    while (i < pattern.size()) {
        char c = pattern[i];
        auto close = (c == '{')
            ? pattern.find('}', i + 1)
            : std::string::npos;
        bool is_group = (c == '{') && (close != std::string::npos);
        if (!is_group) {
            for (auto& s : out) { s += c; }
            ++i;
            continue;
        }
        auto body = pattern.substr(i + 1, close - i - 1);
        out = multiply_alternatives(
            out, split_brace_alternatives(body));
        i = close + 1;
    }
    return out;
}
 
std::string check_read_before_write(
    const FileAccessTracker& tracker,
    const std::string& path) {
    const auto session = current_run_session();
    if (fs::exists(path) && !tracker.was_read(session, path)) {
        logger->warn("Read-before-write violation: session='{}' {}",
                     session, path);
        return make_error("read_before_write",
            "File must be read before writing: " + path);
    }
    return "";
}
 
int count_occurrences(const std::string& content,
                      const std::string& needle) {
    int count = 0;
    size_t pos = 0;
    while ((pos = content.find(needle, pos)) != std::string::npos) {
        count++;
        pos += needle.size();
    }
    return count;
}
 
std::optional<std::string>
apply_str_replace(const std::string& content, const std::string& old_str, const std::string& new_str, bool replace_all, std::string& error_type) {
 
    int occurrences = count_occurrences(content, old_str);
    if (occurrences == 0) {
        error_type = "no_match";
        return std::nullopt;
    }
    if (!replace_all && occurrences > 1) {
        error_type = "multiple_matches";
        return std::nullopt;
    }
 
    std::string result = content;
    auto pos = result.find(old_str);
    while (pos != std::string::npos) {
        result.replace(pos, old_str.size(), new_str);
        if (!replace_all) { break; }
        pos = result.find(old_str, pos + new_str.size());
    }
    return result;
}
 
long count_lines(const std::string& content) {
    long n = static_cast<long>(std::count(content.begin(), content.end(), '\n'));
    return (!content.empty() && content.back() != '\n') ? n + 1 : n;
}
 
std::string apply_insert(const std::string& content,
                         long after,
                         const std::string& new_str) {
    size_t pos = 0;
    for (long line = 0; line < after; ++line) {
        auto nl = content.find('\n', pos);
        pos = (nl == std::string::npos) ? content.size() : nl + 1;
    }
    std::string text = new_str;
    bool at_unterminated_end = pos == content.size() && !content.empty()
        && content.back() != '\n';
    if (at_unterminated_end) {
        text = "\n" + text;
    } else if (text.empty() || text.back() != '\n') {
        text += '\n';
    }
    return content.substr(0, pos) + text + content.substr(pos);
}
 
 
bool any_glob_match(const std::string& filename,
                    const std::vector<std::string>& patterns) {
    for (const auto& p : patterns) {
        if (glob_match(filename, p)) { return true; }
    }
    return false;
}
 
enum class EntryAction {
    kSkip,         
    kSkipPrune,    
    kTake          
};
 
EntryAction classify_glob_entry(
    const fs::directory_entry& entry,
    const fs::path& root,
    const std::vector<std::string>& patterns,
    const IgnoreMatcher* ignore) {
    bool is_dir = entry.is_directory();
    EntryAction result = EntryAction::kSkip;
    bool hardcoded_skip = is_dir
        && should_skip_dir(entry.path().filename().string());
    auto rel = fs::relative(entry.path(), root).generic_string();
    bool ignore_hit = !hardcoded_skip
        && ignore != nullptr
        && !rel.empty()
        && ignore->is_ignored(rel, is_dir);
    if (hardcoded_skip || (ignore_hit && is_dir)) {
        result = EntryAction::kSkipPrune;
    } else if (ignore_hit) {
        result = EntryAction::kSkip;
    } else if (entry.is_regular_file()
               && any_glob_match(rel, patterns)) {
        result = EntryAction::kTake;
    }
    return result;
}
 
void collect_glob_matches(
    const fs::path& root,
    const std::string& pattern,
    const IgnoreMatcher* ignore,
    WalkBudget& budget,
    PagedResult& page) {
 
    auto patterns = expand_braces(pattern);
    auto it = fs::recursive_directory_iterator(
        root, fs::directory_options::skip_permission_denied);
 
    for (auto& entry : it) {
        auto action = classify_glob_entry(entry, root, patterns, ignore);
        if (action == EntryAction::kSkipPrune) {
            it.disable_recursion_pending();
        } else if (action == EntryAction::kTake
                   && !page.offer(display_path(root, entry.path()))) {
            break;
        }
        if (walk_budget_spent(budget)) { break; }
    }
}
 
bool looks_binary(const fs::path& path) {
    std::ifstream in(path, std::ios::binary);
    char buf[8192];
    in.read(buf, sizeof(buf));
    return std::memchr(buf, '\0', static_cast<size_t>(in.gcount())) != nullptr;
}
 
bool grep_file(const fs::path& path, const std::string& display,
               const std::regex& re, PagedResult& page) {
    std::ifstream in(path);
    std::string line;
    long line_num = 0;
    bool keep_going = !looks_binary(path);
    while (keep_going && std::getline(in, line)) {
        ++line_num;
        if (std::regex_search(line, re)) {
            json m;
            m["path"] = display;
            m["line"] = line_num;
            m["content"] = line;
            keep_going = page.offer(std::move(m));
        }
    }
    return !page.full();
}
 
json entry_to_json(const fs::directory_entry& entry, const fs::path& base) {
    json j;
    j["name"] = entry.path().lexically_relative(base).generic_string();
    bool dir = entry.is_directory();
    j["type"] = dir ? "directory" : "file";
    j["size"] = (!dir && entry.is_regular_file())
        ? static_cast<int64_t>(entry.file_size()) : 0;
    return j;
}
 
std::vector<json> collect_entries(const fs::path& dir,
                                  bool recursive,
                                  int max_depth,
                                  WalkBudget& budget) {
    std::vector<json> entries;
    auto it = fs::recursive_directory_iterator(
        dir, fs::directory_options::skip_permission_denied);
    for (auto& entry : it) {
        if (!recursive || it.depth() >= max_depth) {
            it.disable_recursion_pending();
        }
        entries.push_back(entry_to_json(entry, dir));
        if (walk_budget_spent(budget)) { break; }
    }
    std::sort(entries.begin(), entries.end(),
              [](const json& a, const json& b) { return a["name"] < b["name"]; });
    return entries;
}
 
std::string do_str_replace(const json& args,
                           const std::string& content,
                           std::string& out, json& ok) {
    auto old_str = args.at("old_string").get<std::string>();
    auto new_str = args.at("new_string").get<std::string>();
    bool replace_all = args.value("replace_all", false);
 
    std::string error_type;
    auto result = apply_str_replace(
        content, old_str, new_str, replace_all, error_type);
    if (!result.has_value()) {
        auto msg = (error_type == "multiple_matches")
            ? "old_string found multiple times — add context or use replace_all"
            : "old_string not found in file";
        return make_error(error_type, msg);
    }
    out = result.value();
    ok["mode"] = "str_replace";
    ok["replacements"] = replace_all ? count_occurrences(content, old_str) : 1;
    ok["message"] = "Edit applied";
    return "";
}
 
std::string do_insert(const json& args,
                      const std::string& content,
                      std::string& out, json& ok) {
    const long after = args.at("insert_line").get<long>();
    const long total = count_lines(content);
    if (after < 0 || after > total) {
        return make_error("out_of_range", "insert_line must be 0.."
            + std::to_string(total) + " for this file (got "
            + std::to_string(after) + ")");
    }
    out = apply_insert(content, after, args.at("new_string").get<std::string>());
    ok["mode"] = "insert";
    ok["inserted_after"] = after;
    ok["message"] = "Text inserted";
    return "";
}
 
std::string apply_edit(const json& args,
                       const std::filesystem::path& resolved,
                       const std::string& display) {
    const bool replace = args.contains("old_string");
    if (replace == args.contains("insert_line")) {
        return make_error("invalid_args", "edit_file takes exactly one of "
            "old_string (STR_REPLACE) or insert_line (INSERT)");
    }
    auto content = read_file_contents(resolved);
    std::string edited;
    json ok;
    auto out = replace ? do_str_replace(args, content, edited, ok)
                       : do_insert(args, content, edited, ok);
    if (out.empty()) {
        write_file_contents(resolved, edited);
        logger->info("Edited file: {} ({})", display, ok["mode"].get<std::string>());
        ok["path"] = display;
        out = ok.dump();
    }
    return out;
}
 
} // anonymous namespace
 
// ── ReadFileTool ─────────────────────────────────────────
 
class ReadFileTool : public ToolBase {
public:
    ReadFileTool(FilesystemServer& server,
                 const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "read_file", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
    std::string anchor_key(
        const std::string& args_json) const override {
        auto args = json::parse(args_json);
        return "file:" + args.at("path").get<std::string>();
    }
 
private:
    FilesystemServer& server_;
};
 
std::string check_read_gates(FilesystemServer& server,
                             const fs::path& resolved,
                             const std::string& display) {
    std::string err;
    auto rel = fs::relative(resolved, server.root_dir()).generic_string();
    if (!fs::exists(resolved)) {
        err = make_error("not_found",
            "File not found: " + display
            + ". Use list_directory(\".\") to see available files"
              " in the working directory, or verify the path is"
              " relative to the configured root.");
    } else if (fs::is_directory(resolved)) {
        err = make_error("is_directory",
            "Path is a directory, not a file: " + display);
    } else if (!rel.empty() && server.ignore().is_ignored(rel, false)) {
        err = make_error("ignored",
            "Path '" + rel + "' is excluded by .gitignore or "
            ".explorerignore.");
    }
    return err;
}
 
std::string read_window(const json& args, long budget, ReadWindow& w) {
    w.offset = args.value<long>("offset", 1);
    w.limit = args.value<long>("limit", 0);
    w.budget = budget;
    return (1 > w.offset || 0 > w.limit)
        ? make_error("invalid_args", "offset must be >= 1 and limit >= 1")
        : std::string{};
}
 
json read_and_track(FilesystemServer& server, const fs::path& resolved,
                    const std::string& display, const json& args,
                    std::string& err) {
    ReadWindow w;
    err = read_window(args, server.max_read_bytes(), w);
    json result;
    if (err.empty()) { result = read_numbered_lines(resolved, display, w, err); }
    if (err.empty()) {
        server.tracker().record_read(current_run_session(), resolved.string(),
                                     hash_content(result["lines"].dump()));
        logger->info("Read file: {} lines {}..{} of {} (truncated={})",
                     resolved.string(), w.offset,
                     w.offset + static_cast<long>(result["lines"].size()) - 1,
                     result["total"].get<long>(), result["truncated"].get<bool>());
    }
    return result;
}
 
ServerResponse ReadFileTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto resolved = server_.resolve_path(args.at("path").get<std::string>(),
                                         PathAccess::read, name());
    auto display = display_path(server_.root_dir(), resolved);
    auto err = check_read_gates(server_, resolved, display);
    json result;
    if (err.empty()) { result = read_and_track(server_, resolved, display, args, err); }
    return {err.empty() ? result.dump() : err, {}};
}
 
// ── WriteFileTool ────────────────────────────────────────
 
class WriteFileTool : public ToolBase {
public:
    WriteFileTool(FilesystemServer& server,
                  const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "write_file", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_;
};
 
ServerResponse WriteFileTool::execute(
    const std::string& args_json) {
 
    auto args = json::parse(args_json);
    auto requested = args.at("path").get<std::string>();
    auto content = args.at("content").get<std::string>();
    auto resolved = server_.resolve_path(requested, PathAccess::write,
                                         name());
    auto path_str = resolved.string();
 
    auto violation = check_read_before_write(
        server_.tracker(), path_str);
    if (!violation.empty()) {
        return {violation, {}};
    }
 
    write_file_contents(resolved, content);
    logger->info("Wrote file: {} ({} bytes)",
                 path_str, content.size());
 
    json result;
    result["path"] = display_path(server_.root_dir(), resolved);
    result["bytes_written"] = content.size();
    result["message"] = "File written successfully";
    return {result.dump(), {}};
}
 
// ── EditFileTool ─────────────────────────────────────────
 
class EditFileTool : public ToolBase {
public:
    EditFileTool(FilesystemServer& server,
                 const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "edit_file", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_;
};
 
ServerResponse EditFileTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto requested = args.at("path").get<std::string>();
    auto resolved = server_.resolve_path(requested, PathAccess::write,
                                         name());
    auto violation = check_read_before_write(
        server_.tracker(), resolved.string());
    if (!violation.empty()) {
        return {violation, {}};
    }
    return {apply_edit(args, resolved,
                       display_path(server_.root_dir(), resolved)), {}};
}
 
// ── GlobTool ─────────────────────────────────────────────
 
class GlobTool : public ToolBase {
public:
    GlobTool(FilesystemServer& server, const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "glob", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_; 
};
 
ServerResponse GlobTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto pattern = args.at("pattern").get<std::string>();
    Page requested;
    auto err = read_page(args, 500, 5000, requested);
    if (!err.empty()) { return {err, {}}; }
 
    WalkBudget budget{server_.config().max_walk_entries, 0, false};
    PagedResult page(requested);
    collect_glob_matches(server_.root_dir(), pattern, &server_.ignore(),
                         budget, page);
    json result;
    page.finish(result, "paths", budget.truncated);
    logger->info("Glob '{}': {} paths, {} entries walked, truncated={}{}",
                 pattern, result["paths"].size(), budget.visited,
                 result["truncated"].get<bool>(),
                 budget.truncated ? " (walk cap — narrow the pattern)" : "");
    return {result.dump(), {}};
}
 
// ── GrepTool ─────────────────────────────────────────────
 
class GrepTool : public ToolBase {
public:
    GrepTool(FilesystemServer& server, const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "grep", "filesystem",
              /* tools dir: */ data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_; 
};
 
std::regex compile_grep_or_error(const std::string& pattern,
                                 std::string& err) {
    try {
        return std::regex(pattern);
    } catch (const std::regex_error& e) {
        err = make_error("invalid_regex", e.what());
        return std::regex("(?!)");
    }
}
 
static void grep_search(
    const fs::path& root, const fs::path& start,
    const std::vector<std::string>& file_patterns,
    const std::regex& re, const IgnoreMatcher& ignore,
    WalkBudget& budget, PagedResult& page) {
    auto it = fs::recursive_directory_iterator(
        start, fs::directory_options::skip_permission_denied);
    for (auto& entry : it) {
        auto action = classify_glob_entry(entry, root, file_patterns,
                                          &ignore);
        if (action == EntryAction::kSkipPrune) {
            it.disable_recursion_pending();
        } else if (action == EntryAction::kTake
                   && !grep_file(entry.path(),
                                 display_path(root, entry.path()), re, page)) {
            break;
        }
        if (walk_budget_spent(budget)) { break; }
    }
}
 
static void grep_target(FilesystemServer& server, const fs::path& start,
                        const json& args, const std::regex& re,
                        WalkBudget& budget, PagedResult& page) {
    const auto& root = server.root_dir();
    if (fs::is_regular_file(start)) {
        grep_file(start, display_path(root, start), re, page);
    } else {
        grep_search(root, start,
                    expand_braces(args.value("glob", std::string("*"))),
                    re, server.ignore(), budget, page);
    }
}
 
static std::string grep_preflight(const json& args, const fs::path& start,
                                  const fs::path& root, Page& requested,
                                  std::regex& re) {
    std::string err = read_page(args, 100, 1000, requested);
    re = compile_grep_or_error(args.at("pattern").get<std::string>(), err);
    if (err.empty() && !fs::exists(start)) {
        err = make_error("not_found", "No such file or directory: "
                         + display_path(root, start));
    }
    return err;
}
 
ServerResponse GrepTool::execute(const std::string& args_json) {
    auto args = json::parse(args_json);
    auto start = server_.resolve_path(args.value("path", std::string(".")),
                                      PathAccess::read, name());
    Page requested;
    std::regex re;
    auto err = grep_preflight(args, start, server_.root_dir(), requested, re);
    if (!err.empty()) { return {err, {}}; }
 
    WalkBudget budget{server_.config().max_walk_entries, 0, false};
    PagedResult page(requested);
    grep_target(server_, start, args, re, budget, page);
    json result;
    page.finish(result, "matches", budget.truncated);
    logger->info("Grep '{}' in {}: {} matches, {} entries walked, truncated={}",
                 args.at("pattern").get<std::string>(), start.string(),
                 result["matches"].size(), budget.visited,
                 result["truncated"].get<bool>());
    return {result.dump(), {}};
}
 
// ── ListDirectoryTool ────────────────────────────────────
 
class ListDirectoryTool : public ToolBase {
public:
    ListDirectoryTool(FilesystemServer& server,
                      const std::string& data_dir)
        : ToolBase(load_tool_definition(
              "list_directory", "filesystem",
              data_dir + "/tools")),
          server_(server) {}
 
    MCPAccessLevel required_access_level() const override {
        return MCPAccessLevel::READ;
    }
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    FilesystemServer& server_;
};
 
static void list_page(const fs::path& dir, const json& args, Page requested,
                      int max_walk, json& result) {
    WalkBudget budget{max_walk, 0, false};
    PagedResult page(requested);
    for (auto& e : collect_entries(dir, args.value("recursive", false),
                                   args.value("max_depth", 3), budget)) {
        if (!page.offer(std::move(e))) { break; }
    }
    page.finish(result, "entries", budget.truncated);
}
 
ServerResponse ListDirectoryTool::execute(
    const std::string& args_json) {
 
    auto args = json::parse(args_json);
    auto resolved = server_.resolve_path(args.value("path", std::string(".")),
                                         PathAccess::read, name());
    auto display = display_path(server_.root_dir(), resolved);
    Page requested;
    auto err = read_page(args, 500, 5000, requested);
    if (err.empty() && !fs::is_directory(resolved)) {
        err = make_error("not_directory", "Not a directory: " + display);
    }
    if (!err.empty()) { return {err, {}}; }
 
    json result;
    result["path"] = display;
    list_page(resolved, args, requested, server_.config().max_walk_entries, result);
    logger->info("Listed {}: {} entries, truncated={}", display,
                 result["entries"].size(), result["truncated"].get<bool>());
    return {result.dump(), {}};
}
 
// ── FilesystemServer ─────────────────────────────────────
 
static int compute_max_read_bytes(const FilesystemConfig& config,
                                  int model_context_bytes) {
    if (config.max_read_bytes.has_value()) {
        return config.max_read_bytes.value();
    }
    if (model_context_bytes <= 0) {
        // Safe default: 32KB prevents a single file from blowing typical
        // context budgets (16-128K). Large files trigger size_exceeded and
        // the model must use offset/limit or docs.* tools instead.
        return 32 * 1024;
    }
    return static_cast<int>(
        model_context_bytes * config.max_read_context_pct);
}
 
FilesystemServer::FilesystemServer(
    const fs::path& root_dir,
    const FilesystemConfig& config,
    const std::string& data_dir,
    int model_context_bytes)
    : MCPServerBase("filesystem"),
      root_dir_(fs::weakly_canonical(root_dir)),
      config_(config),
      max_read_bytes_(compute_max_read_bytes(
          config, model_context_bytes)) {
 
    create_fs_tools(data_dir);
    register_fs_tools();
 
    // Issue #15 (v2.1.4): load .gitignore + .explorerignore so glob,
    // grep, and read_file can filter out build artifacts and vendor
    // blobs that pre-2.1.4 leaked into results.
    ignore_.load(root_dir_);
 
    logger->info("FilesystemServer initialized: root={}, "
                 "max_read_bytes={}, ignore_rules={}",
                 root_dir_.string(),
                 max_read_bytes_,
                 ignore_.rule_count());
    log_outside_root_policy();  // v2.13.0: the posture is observable
}
 
void FilesystemServer::create_fs_tools(const std::string& data_dir) {
    read_file_ = std::make_unique<ReadFileTool>(*this, data_dir);
    write_file_ = std::make_unique<WriteFileTool>(*this, data_dir);
    edit_file_ = std::make_unique<EditFileTool>(*this, data_dir);
    glob_ = std::make_unique<GlobTool>(*this, data_dir);
    grep_ = std::make_unique<GrepTool>(*this, data_dir);
    list_dir_ = std::make_unique<ListDirectoryTool>(*this, data_dir);
}
 
void FilesystemServer::register_fs_tools() {
    register_tool(read_file_.get());
    register_tool(write_file_.get());
    register_tool(edit_file_.get());
    register_tool(glob_.get());
    register_tool(grep_.get());
    register_tool(list_dir_.get());
}
 
FilesystemServer::~FilesystemServer() = default;
 
bool FilesystemServer::skip_duplicate_check(
    const std::string& tool_name) const {
    return tool_name == "read_file";
}
 
bool FilesystemServer::set_working_dir(const std::string& path) {
    auto canonical = fs::weakly_canonical(path);
    if (!fs::is_directory(canonical)) {
        logger->error("set_working_dir: not a directory: {}",
                      path);
        return false;
    }
    root_dir_ = canonical;
    // Issue #15 (v2.1.4): reload ignore rules for the new root.
    ignore_.load(root_dir_);
    logger->info("Working directory changed to: {} (ignore_rules={})",
                 root_dir_.string(), ignore_.rule_count());
    // v2.13.0: "outside the root" just moved; say what that now means.
    log_outside_root_policy();
    return true;
}
 
const fs::path& FilesystemServer::root_dir() const {
    return root_dir_;
}
 
FileAccessTracker& FilesystemServer::tracker() {
    return tracker_;
}
 
bool FilesystemServer::release_session(const std::string& key) {
    return tracker_.release_session(key);
}
 
std::size_t FilesystemServer::session_count() const {
    return tracker_.session_count();
}
 
const IgnoreMatcher& FilesystemServer::ignore() const {
    return ignore_;
}
 
const FilesystemConfig& FilesystemServer::config() const {
    return config_;
}
 
int FilesystemServer::max_read_bytes() const {
    return max_read_bytes_;
}
 
fs::path FilesystemServer::resolve_path(
    const std::string& requested, PathAccess access,
    const std::string& tool) const {
 
    fs::path req_path(requested);
    fs::path resolved = req_path.is_absolute()
        ? fs::weakly_canonical(req_path)
        : fs::weakly_canonical(root_dir_ / req_path);
 
    if (!path_within(resolved, root_dir_)) {
        authorize_outside_root(resolved, access, tool);
    }
    return resolved;
}
 
void FilesystemServer::authorize_outside_root(
    const fs::path& resolved, PathAccess access,
    const std::string& tool) const {
    auto denied = first_containing(config_.outside_root_deny, resolved);
    auto allowed = first_containing(config_.outside_root_allow, resolved);
    const auto mode = config_.allow_outside_root;
    if (denied.has_value()) {
        refuse_denied(resolved, *denied, access, root_dir_);
    } else if (allowed.has_value() || mode == OutsideRootAccess::allow) {
        log_outside_root_served(resolved, access, allowed);
    } else if (mode == OutsideRootAccess::refuse) {
        refuse_escape(resolved, root_dir_);
    } else {
        ask_outside_root_approver(resolved, access, tool);
    }
}
 
void FilesystemServer::ask_outside_root_approver(
    const fs::path& resolved, PathAccess access,
    const std::string& tool) const {
    OutsideRootApprover fn = nullptr;
    void* ud = nullptr;
    {
        std::lock_guard<std::mutex> lock(approver_mutex_);
        fn = approver_;
        ud = approver_data_;
    }
    OutsideRootRequest req{resolved.string(), root_dir_.string(),
                           name() + "." + tool, access};
    auto verdict = fn != nullptr ? fn(req, ud)
                                 : OutsideRootVerdict::no_approver;
    if (verdict == OutsideRootVerdict::approved) {
        logger->info("Outside-root {} APPROVED by host: {} ({})",
                     access_verb(access), req.path, req.tool);
    } else {
        auto msg = outside_root_refusal(verdict, req);
        logger->error("Path escape blocked: {}", msg);
        throw std::runtime_error(msg);
    }
}
 
void FilesystemServer::set_outside_root_approver(
    OutsideRootApprover fn, void* user_data) {
    std::lock_guard<std::mutex> lock(approver_mutex_);
    approver_ = fn;
    approver_data_ = user_data;
    logger->info("Outside-root approver {} (root: {})",
                 fn != nullptr ? "installed" : "cleared",
                 root_dir_.string());
}
 
void FilesystemServer::log_outside_root_policy() const {
    const auto& deny = config_.outside_root_deny;
    if (config_.allow_outside_root == OutsideRootAccess::allow) {
        logger->warn("Outside-root policy: allow_outside_root=true — every "
                     "path outside {} is served (deny={})",
                     root_dir_.string(), join_paths(deny));
    } else {
        logger->info("Outside-root policy: allow_outside_root={} allow={} "
                     "deny={} (root: {})",
                     outside_root_mode_name(config_.allow_outside_root),
                     join_paths(config_.outside_root_allow),
                     join_paths(deny), root_dir_.string());
    }
    warn_deny_entries_inside_root(deny, root_dir_);
}
 
} // namespace entropic