@aaarc/handfree-ssh-mcp 1.0.0 → 1.0.1

package/build/tools/show-whitelist.js

@@ -1,7 +1,71 @@
 import { z } from "zod";
-import { SSHConnectionManager } from "../services/ssh-connection-manager.js";
+import { BUILT_IN_COMMAND_BLACKLIST, BUILT_IN_DESTRUCTIVE_GUARDS, SSHConnectionManager, } from "../services/ssh-connection-manager.js";
 import { Logger } from "../utils/logger.js";
 import { ToolError, formatToolErrorResponse, toToolError } from "../utils/tool-error.js";
+export function formatCommandPolicy(config) {
+    const whitelist = config.commandWhitelist || [];
+    const blacklist = config.commandBlacklist || [];
+    const commandMode = config.commandMode
+        ?? (whitelist.length > 0 ? "whitelist" : "blacklist");
+    let output = `## Command Policy\n\n`;
+    output += `Mode: \`${commandMode}\``;
+    if (!config.commandMode && whitelist.length > 0) {
+        output += ` _(legacy whitelist config)_`;
+    }
+    output += `\n\n`;
+    output += `Built-in destructive command guards:\n\n`;
+    for (const { regex, reason } of BUILT_IN_DESTRUCTIVE_GUARDS) {
+        output += `- \`${regex.source}\` -> ${reason}\n`;
+    }
+    output += `\n`;
+    output += `Built-in dangerous-command blacklist:\n\n`;
+    for (const { regex, reason } of BUILT_IN_COMMAND_BLACKLIST) {
+        output += `- \`${regex.source}\` -> ${reason}\n`;
+    }
+    output += `\n`;
+    output += `## Allowed Commands (Whitelist)\n\n`;
+    if (commandMode !== "whitelist") {
+        output += `Whitelist is inactive in blacklist mode.\n\n`;
+    }
+    else if (whitelist.length === 0) {
+        output += `WARNING: Whitelist mode is active but no whitelist patterns are configured, so all commands are blocked after blacklist checks.\n\n`;
+    }
+    else {
+        output += `${whitelist.length} patterns:\n\n`;
+        for (const pattern of whitelist) {
+            const readable = patternToReadable(pattern);
+            output += `- \`${pattern}\``;
+            if (readable !== pattern) {
+                output += ` -> ${readable}`;
+            }
+            output += `\n`;
+        }
+        output += `\n`;
+    }
+    if (blacklist.length > 0) {
+        output += `## Blocked Commands (Blacklist)\n\n`;
+        output += `${blacklist.length} patterns:\n\n`;
+        for (const pattern of blacklist) {
+            const readable = patternToReadable(pattern);
+            output += `- \`${pattern}\``;
+            if (readable !== pattern) {
+                output += ` -> ${readable}`;
+            }
+            output += `\n`;
+        }
+        output += `\n`;
+    }
+    if (commandMode === "whitelist" && whitelist.length > 0) {
+        output += `## Example Commands\n\n`;
+        output += `Based on the active whitelist, here are some commands you can likely use:\n\n`;
+        const examples = generateExamples(whitelist);
+        for (const ex of examples.slice(0, 10)) {
+            output += `- \`${ex}\`\n`;
+        }
+        output += `\n`;
+    }
+    return output;
+}
 /**
  * Register show-whitelist tool
  *
@@ -9,7 +73,7 @@ import { ToolError, formatToolErrorResponse, toToolError } from "../utils/tool-e
  */
 export function registerShowWhitelistTool(server) {
     const sshManager = SSHConnectionManager.getInstance();
-    server.tool("show-whitelist", "Show the configured whitelist, blacklist, and SFTP path policy (allowedRemoteDirectories / allowedLocalDirectories) for a server. Use this before execute-command when you need to understand which commands are allowed, why a command may be rejected, or what command patterns are safe to try next. Also use it before upload / download / transfer to see which paths SFTP is permitted to touch.", {
+    server.tool("show-whitelist", "Show the configured command policy, blacklist/whitelist patterns, and SFTP path policy (allowedRemoteDirectories / allowedLocalDirectories) for a server. Use this before execute-command when you need to understand which commands are allowed, why a command may be rejected, or what command patterns are safe to try next. Also use it before upload / download / transfer to see which paths SFTP is permitted to touch.", {
         connectionName: z
             .string()
             .optional()
@@ -28,41 +92,9 @@ export function registerShowWhitelistTool(server) {
                     isError: true,
                 };
             }
-            const whitelist = config.commandWhitelist || [];
-            const blacklist = config.commandBlacklist || [];
             let output = `# Command Permissions for: ${config.name}\n\n`;
             output += `Host: ${config.username}@${config.host}:${config.port}\n\n`;
-            // Whitelist
-            output += `## ✅ Allowed Commands (Whitelist)\n\n`;
-            if (whitelist.length === 0) {
-                output += `⚠️ No whitelist configured - using default safe commands.\n\n`;
-            }
-            else {
-                output += `${whitelist.length} patterns:\n\n`;
-                for (const pattern of whitelist) {
-                    const readable = patternToReadable(pattern);
-                    output += `- \`${pattern}\``;
-                    if (readable !== pattern) {
-                        output += ` → ${readable}`;
-                    }
-                    output += `\n`;
-                }
-                output += `\n`;
-            }
-            // Blacklist
-            if (blacklist.length > 0) {
-                output += `## ❌ Blocked Commands (Blacklist)\n\n`;
-                output += `${blacklist.length} patterns:\n\n`;
-                for (const pattern of blacklist) {
-                    const readable = patternToReadable(pattern);
-                    output += `- \`${pattern}\``;
-                    if (readable !== pattern) {
-                        output += ` → ${readable}`;
-                    }
-                    output += `\n`;
-                }
-                output += `\n`;
-            }
+            output += formatCommandPolicy(config);
             // SFTP path policy (upload / download / transfer tools only)
             const allowedRemoteDirs = config.allowedRemoteDirectories ?? [];
             const allowedLocalDirs = config.allowedLocalDirectories ?? [];
@@ -112,13 +144,6 @@ export function registerShowWhitelistTool(server) {
             output += `- This server's logs land under: \`${serverLogDir}/\`\n`;
             output += `- File name: \`<timestamp>-<pid>-<rand>.log\` with \`=== META / STDOUT / STDERR / END ===\` markers.\n`;
             output += `- When output is truncated, the response includes an \`[OUTPUT TRUNCATED]\` header with the on-disk log path.\n\n`;
-            // Quick examples
-            output += `## 💡 Example Commands\n\n`;
-            output += `Based on the whitelist, here are some commands you can likely use:\n\n`;
-            const examples = generateExamples(whitelist);
-            for (const ex of examples.slice(0, 10)) {
-                output += `- \`${ex}\`\n`;
-            }
             return {
                 content: [{ type: "text", text: output }],
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaarc/handfree-ssh-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Handfree SSH MCP Server - A hands-free SSH automation tool via MCP protocol",
   "main": "build/index.js",
   "type": "module",
@@ -15,7 +15,10 @@
     "url": "https://github.com/Ironboxplus/handfree-ssh-mcp/issues"
   },
   "homepage": "https://github.com/Ironboxplus/handfree-ssh-mcp#readme",
-  "scripts": {
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
     "test": "npm run build && node --test build/tests/config.test.js build/tests/command-validation.test.js build/tests/tool-error.test.js build/tests/tools.test.js build/tests/output-collector.test.js build/tests/output-log-writer.test.js build/tests/recent-fixes.test.js",
     "test:config": "npm run build && node --test build/tests/config.test.js",
     "test:cmd": "npm run build && node --test build/tests/command-validation.test.js",
@@ -46,7 +49,13 @@
     "@types/ssh2": "^1.15.5",
     "typescript": "^5.8.2"
   },
-  "files": [
-    "build/**/*"
-  ]
-}
+  "files": [
+    "build/config/**/*",
+    "build/core/**/*",
+    "build/models/**/*",
+    "build/services/**/*",
+    "build/tools/**/*",
+    "build/utils/**/*",
+    "build/index.js"
+  ]
+}