@1ly/mcp-server 0.1.3 → 0.1.5

package/dist/wallet/solana.js

@@ -38,18 +38,59 @@ exports.getWalletAddress = getWalletAddress;
 exports.buildSolanaPaymentSignature = buildSolanaPaymentSignature;
 const web3_js_1 = require("@solana/web3.js");
 const fs = __importStar(require("fs"));
+const path_1 = require("path");
+const os = __importStar(require("os"));
 const client_1 = require("@x402/core/client");
 const http_1 = require("@x402/core/http");
 const client_2 = require("@x402/svm/exact/client");
 const svm_1 = require("@x402/svm");
 const signers_1 = require("@solana/signers");
+function expandTilde(inputPath) {
+    if (!inputPath.startsWith("~/"))
+        return inputPath;
+    return (0, path_1.resolve)(os.homedir(), inputPath.slice(2));
+}
+/**
+ * Validates wallet file path to prevent directory traversal attacks.
+ * Only allows files in home directory or /tmp (for testing).
+ */
+function validateWalletPath(keyPath) {
+    try {
+        const normalizedPath = (0, path_1.normalize)((0, path_1.resolve)(keyPath));
+        const homeDir = os.homedir();
+        // Allow files in home directory or /tmp
+        const isInHome = normalizedPath.startsWith(homeDir);
+        const isInTmp = normalizedPath.startsWith("/tmp") || normalizedPath.startsWith(os.tmpdir());
+        if (!isInHome && !isInTmp) {
+            throw new Error("Wallet file must be in home directory or /tmp for security. Path: " + normalizedPath);
+        }
+        // Block sensitive directories
+        const blockedPaths = [".ssh", ".gnupg", ".aws", ".kube"];
+        if (blockedPaths.some((p) => normalizedPath.includes(`/${p}/`))) {
+            throw new Error("Cannot load wallet from sensitive directory");
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.includes("Wallet file must be")) {
+            throw err;
+        }
+        throw new Error("Invalid wallet file path");
+    }
+}
 async function loadSolanaWallet(keyPath) {
     let keyData;
     if (keyPath.startsWith("[")) {
+        // Inline JSON array format - no path validation needed
         keyData = JSON.parse(keyPath);
     }
-    else if (fs.existsSync(keyPath)) {
-        const fileContent = fs.readFileSync(keyPath, "utf-8");
+    else {
+        const expandedPath = expandTilde(keyPath);
+        if (!fs.existsSync(expandedPath)) {
+            throw new Error(`Wallet key file not found: ${keyPath}`);
+        }
+        // File path - validate before reading
+        validateWalletPath(expandedPath);
+        const fileContent = fs.readFileSync(expandedPath, "utf-8");
         const parsed = JSON.parse(fileContent);
         // Handle both formats:
         // 1. { publicKey: "...", secretKey: [...] } - test wallet format
@@ -64,9 +105,6 @@ async function loadSolanaWallet(keyPath) {
             throw new Error("Invalid wallet file format");
         }
     }
-    else {
-        throw new Error(`Wallet key file not found: ${keyPath}`);
-    }
     return web3_js_1.Keypair.fromSecretKey(Uint8Array.from(keyData));
 }
 async function getWalletAddress(type, key) {

package/dist/wallet/solana.js.map

@@ -1 +1 @@
-{"version":3,"file":"solana.js","sourceRoot":"","sources":["../../src/wallet/solana.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,4CAwBC;AAED,4CASC;AAED,kEAwBC;AAtED,6CAA0C;AAC1C,uCAAyB;AACzB,8CAA+C;AAC/C,0CAAiD;AACjD,mDAAgE;AAChE,mCAA8C;AAC9C,6CAA+D;AAGxD,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,IAAI,OAAiB,CAAC;IAEtB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEvC,uBAAuB;QACvB,iEAAiE;QACjE,4CAA4C;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,iBAAO,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,IAAsB,EACtB,GAAW;IAEX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAC/C,eAAgC,EAChC,MAAe;IAEf,MAAM,MAAM,GAAG,MAAM,IAAA,sCAA4B,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAA,uBAAiB,EAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,mBAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;QAC/C,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,CAAC,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAA,+BAAsB,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,qBAAc,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,UAAU,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAExE,OAAO,CACL,OAAO,CAAC,mBAAmB,CAAC;QAC5B,OAAO,CAAC,mBAAmB,CAAC;QAC5B,OAAO,CAAC,mBAAmB,CAAC;QAC5B,OAAO,CAAC,WAAW,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"solana.js","sourceRoot":"","sources":["../../src/wallet/solana.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,4CA6BC;AAED,4CASC;AAED,kEAwBC;AAlHD,6CAA0C;AAC1C,uCAAyB;AACzB,+BAA0C;AAC1C,uCAAyB;AACzB,8CAA+C;AAC/C,0CAAiD;AACjD,mDAAgE;AAChE,mCAA8C;AAC9C,6CAA+D;AAG/D,SAAS,WAAW,CAAC,SAAiB;IACpC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,IAAA,cAAO,EAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAA,gBAAS,EAAC,IAAA,cAAO,EAAC,OAAO,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAE7B,wCAAwC;QACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5F,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,oEAAoE,GAAG,cAAc,CACtF,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,IAAI,OAAiB,CAAC;IAEtB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,uDAAuD;QACvD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,sCAAsC;QACtC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEvC,uBAAuB;QACvB,iEAAiE;QACjE,4CAA4C;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,iBAAO,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,IAAsB,EACtB,GAAW;IAEX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAC/C,eAAgC,EAChC,MAAe;IAEf,MAAM,MAAM,GAAG,MAAM,IAAA,sCAA4B,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAA,uBAAiB,EAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,mBAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;QAC/C,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,CAAC,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAA,+BAAsB,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,qBAAc,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,UAAU,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAExE,OAAO,CACL,OAAO,CAAC,mBAAmB,CAAC;QAC5B,OAAO,CAAC,mBAAmB,CAAC;QAC5B,OAAO,CAAC,mBAAmB,CAAC;QAC5B,OAAO,CAAC,WAAW,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1ly/mcp-server",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "MCP server for 1ly.store - Discover and pay for APIs with AI agents",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,5 +66,8 @@
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
     "vitest": "^2.0.0"
+  },
+  "overrides": {
+    "borsh": "^2.0.0"
   }
 }