@aaarc/handfree-ssh-mcp 1.0.2 → 1.0.4

package/README.md

@@ -268,7 +268,7 @@ Rules (enforced at config load — bad configs fail fast):
 - **Independent policy.** The target authenticates with its OWN `username` / `password` / `privateKey`, and its own `whitelist` / `blacklist` / `safeDirectory` / `allowed*Directories` apply. The jump host is purely transport.
 - **Jump host is still a normal server.** You can run tools against `bastion` directly; its connection is separate from the tunneling one.
 
-**Hot-reload note:** `jumpHost` is connection-level, not policy-level. Editing it in `servers.yaml` while the server is running will NOT take effect — the hot-reloader only refreshes whitelist / blacklist / `safeDirectory` / `allowed*Directories`. Restart the MCP server to pick up `jumpHost` changes.
+**Hot-reload note:** `jumpHost` is a connection-level field, so it hot-reloads. Editing a server's `jumpHost` (or any hop's connection fields) in `servers.yaml` resets the affected connection on the fly — the change takes effect on the next tool call, no restart needed. This is chain-aware: if an intermediate hop's host / port / credentials change, every target that tunnels through it is reset too.
 
 ### Connection lifecycle (connect / reconnect)
 

package/build/config/config-loader.js

@@ -148,6 +148,12 @@ function buildYamlServerConfig(name, serverConfig, options = {}) {
     if (serverConfig.blacklist !== undefined) {
         merged.commandBlacklist = serverConfig.blacklist ?? undefined;
     }
+    if (serverConfig.disableBuiltinGuards !== undefined) {
+        merged.disableBuiltinGuards = serverConfig.disableBuiltinGuards === true;
+    }
+    if (serverConfig.disableBuiltinBlacklist !== undefined) {
+        merged.disableBuiltinBlacklist = serverConfig.disableBuiltinBlacklist === true;
+    }
     if (serverConfig.safeDirectory !== undefined) {
         merged.safeDirectory = serverConfig.safeDirectory ?? undefined;
     }
@@ -175,6 +181,8 @@ function mergeConfigMaps(sshConfigs, yamlConfigs) {
             commandMode: yamlConfig.commandMode ?? merged[name]?.commandMode,
             commandWhitelist: yamlConfig.commandWhitelist ?? merged[name]?.commandWhitelist,
             commandBlacklist: yamlConfig.commandBlacklist ?? merged[name]?.commandBlacklist,
+            disableBuiltinGuards: yamlConfig.disableBuiltinGuards ?? merged[name]?.disableBuiltinGuards,
+            disableBuiltinBlacklist: yamlConfig.disableBuiltinBlacklist ?? merged[name]?.disableBuiltinBlacklist,
             safeDirectory: yamlConfig.safeDirectory ?? merged[name]?.safeDirectory,
         };
     }

package/build/config/server.js

@@ -1,6 +1,6 @@
 export const SERVER_CONFIG = {
     name: "ssh-mcp-server",
-    version: "1.0.2",
+    version: "1.0.4",
 };
 export const SERVER_INSTRUCTIONS = `This server provides SSH access to servers loaded from OpenSSH config (~/.ssh/config by default) and optional YAML config/policy overlays.
 

package/build/services/ssh-connection-manager.js

@@ -29,23 +29,10 @@ export const BUILT_IN_COMMAND_BLACKLIST = [
     { regex: /\bRemove-Item\b(?=.*\s-Recurse(?:\s|$))(?=.*\s-Force(?:\s|$))/i, reason: "recursive force Remove-Item" },
     { regex: /^\s*(?:del|erase|rd)\b(?=.*(?:\/s\b|\s-Recurse(?:\s|$)))(?=.*(?:\/q\b|\s-Force(?:\s|$)))/i, reason: "recursive quiet Windows delete" },
     { regex: /^\s*(?:sudo\s+)?rmdir\s+(?:\/|\*|~|\$HOME|%USERPROFILE%|[A-Za-z]:\\)(?:\s|$)/i, reason: "dangerous rmdir target" },
-    { regex: /^\s*(?:sudo\s+)?dd\b.*\bof=/i, reason: "dd with of= (can overwrite devices/files)" },
-    { regex: /^\s*(?:sudo\s+)?mkfs(?:\.\S+)?\b/i, reason: "filesystem formatting command" },
-    { regex: /^\s*(?:sudo\s+)?(?:diskpart|format)(?:\s|$)/i, reason: "disk formatting command" },
-    { regex: /\b(?:Format-Volume|Clear-Disk|Remove-Partition)\b/i, reason: "Windows disk destructive command" },
     { regex: /^\s*(?:sudo\s+)?chmod\s+-R\s+777\b/i, reason: "recursive world-writable chmod" },
     { regex: /^\s*(?:sudo\s+)?chown\s+-R\s+\S+\s+\/(?:\s|$)/i, reason: "recursive chown on root" },
 ];
 export const BUILT_IN_DESTRUCTIVE_GUARDS = [
-    { regex: /\brm\b/, reason: "rm in command chain" },
-    { regex: /\brmdir\b/, reason: "rmdir in command chain" },
-    { regex: /\bunlink\b/, reason: "unlink in command chain" },
-    { regex: /\bshred\b/, reason: "shred in command chain" },
-    { regex: /\btruncate\b/, reason: "truncate in command chain" },
-    { regex: /-delete\b/, reason: "find -delete detected" },
-    { regex: /-exec\s+rm\b/, reason: "find -exec rm detected" },
-    { regex: /\bmv\b/, reason: "mv detected (can overwrite)" },
-    { regex: /\bcp\b.*-f/, reason: "cp -f detected (force overwrite)" },
     { regex: /(?<![0-9])>\s*\/(?!dev\/null)/, reason: "output redirection to absolute path" },
     { regex: />\s*~/, reason: "output redirection to home path" },
 ];
@@ -116,18 +103,52 @@ export class SSHConnectionManager {
      */
     replaceConfig(configs, enabledServers) {
         const previous = this.configs;
-        const changedConnections = [];
+        // Pass 1: servers whose own connection fields changed (or that vanished).
+        const directlyChanged = new Set();
         for (const [name, oldConfig] of Object.entries(previous)) {
             const nextConfig = configs[name];
             if (!nextConfig || this.connectionFieldsChanged(oldConfig, nextConfig)) {
-                this.closeClient(name, true);
-                this.statusCache.delete(name);
-                changedConnections.push(name);
+                directlyChanged.add(name);
             }
         }
+        // Pass 2: a target must ALSO reset if any hop in its jump chain directly
+        // changed — otherwise it keeps tunneling through a stale intermediate hop.
+        // Walk both the old and new chains so topology shifts (added/removed hops)
+        // are covered too.
+        const toReset = new Set(directlyChanged);
+        for (const name of Object.keys(previous)) {
+            if (toReset.has(name))
+                continue;
+            if (this.jumpChainTouchesChanged(name, previous, directlyChanged) ||
+                this.jumpChainTouchesChanged(name, configs, directlyChanged)) {
+                toReset.add(name);
+            }
+        }
+        for (const name of toReset) {
+            this.closeClient(name, true);
+            this.statusCache.delete(name);
+        }
         this.setConfig(configs, enabledServers);
         Logger.log(`Hot-reloaded SSH config: ${Object.keys(configs).length} server(s), ` +
-            `${changedConnections.length} connection(s) reset`, "info");
+            `${toReset.size} connection(s) reset`, "info");
+    }
+    /**
+     * Walk `name`'s jump chain in `configMap` and report whether any hop is in the
+     * `changed` set. Guards against cycles defensively (config load rejects them).
+     * @private
+     */
+    jumpChainTouchesChanged(name, configMap, changed) {
+        const seen = new Set([name]);
+        let hop = configMap[name]?.jumpHost;
+        while (hop !== undefined) {
+            if (changed.has(hop))
+                return true;
+            if (seen.has(hop))
+                break;
+            seen.add(hop);
+            hop = configMap[hop]?.jumpHost;
+        }
+        return false;
     }
     /**
      * Set the root directory under which execute-command full-output logs are
@@ -790,7 +811,9 @@ export class SSHConnectionManager {
             || (config.username
                 ? (config.username === 'root' ? '/root' : `/home/${config.username}`)
                 : SSHConnectionManager.DEFAULT_SAFE_DIRECTORY);
-        const destructiveReason = this.getDestructiveMatch(command);
+        const destructiveReason = config.disableBuiltinGuards
+            ? null
+            : this.getDestructiveMatch(command);
         if (destructiveReason) {
             // Command contains rm/rmdir - check if it's a simple rm command or hidden in a chain
             const trimmed = command.trim();
@@ -818,13 +841,15 @@ export class SSHConnectionManager {
         // ========================================
         // LAYER 2: Built-in blacklist for high-risk operations
         // ========================================
-        for (const { regex, reason } of BUILT_IN_COMMAND_BLACKLIST) {
-            if (regex.test(command)) {
-                Logger.log(`Command blocked by built-in blacklist (${reason}): ${command}`, "info");
-                return {
-                    isAllowed: false,
-                    reason: `Command blocked by built-in blacklist: ${reason}`,
-                };
+        if (!config.disableBuiltinBlacklist) {
+            for (const { regex, reason } of BUILT_IN_COMMAND_BLACKLIST) {
+                if (regex.test(command)) {
+                    Logger.log(`Command blocked by built-in blacklist (${reason}): ${command}`, "info");
+                    return {
+                        isAllowed: false,
+                        reason: `Command blocked by built-in blacklist: ${reason}`,
+                    };
+                }
             }
         }
         // ========================================

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "@aaarc/handfree-ssh-mcp",
-  "version": "1.0.2",
-  "description": "Handfree SSH MCP Server - A hands-free SSH automation tool via MCP protocol",
-  "main": "build/index.js",
-  "type": "module",
-  "bin": {
-    "handfree-ssh-mcp": "build/index.js"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Ironboxplus/handfree-ssh-mcp.git"
-  },
-  "bugs": {
-    "url": "https://github.com/Ironboxplus/handfree-ssh-mcp/issues"
-  },
-  "homepage": "https://github.com/Ironboxplus/handfree-ssh-mcp#readme",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "test": "npm run build && node --test build/tests/config.test.js build/tests/command-validation.test.js build/tests/tool-error.test.js build/tests/tools.test.js build/tests/output-collector.test.js build/tests/output-log-writer.test.js build/tests/recent-fixes.test.js",
-    "test:config": "npm run build && node --test build/tests/config.test.js",
-    "test:cmd": "npm run build && node --test build/tests/command-validation.test.js",
-    "test:tools": "npm run build && node --test build/tests/tools.test.js",
-    "test:integration": "npm run build && node build/tests/integration.test.js",
-    "test:all": "npm run test && npm run test:integration",
-    "build": "node scripts/build.js",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "ssh",
-    "mcp",
-    "server",
-    "cli"
-  ],
-  "author": "Junki",
-  "license": "ISC",
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "1.17.5",
-    "js-yaml": "^4.1.0",
-    "socks": "^2.8.6",
-    "ssh2": "^1.16.0",
-    "zod": "^3.24.2"
-  },
-  "devDependencies": {
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.13.10",
-    "@types/ssh2": "^1.15.5",
-    "typescript": "^5.8.2"
-  },
-  "files": [
-    "build/config/**/*",
-    "build/core/**/*",
-    "build/models/**/*",
-    "build/services/**/*",
-    "build/tools/**/*",
-    "build/utils/**/*",
-    "build/index.js"
-  ]
-}
+{
+  "name": "@aaarc/handfree-ssh-mcp",
+  "version": "1.0.4",
+  "description": "Handfree SSH MCP Server - A hands-free SSH automation tool via MCP protocol",
+  "main": "build/index.js",
+  "type": "module",
+  "bin": {
+    "handfree-ssh-mcp": "build/index.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ironboxplus/handfree-ssh-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Ironboxplus/handfree-ssh-mcp/issues"
+  },
+  "homepage": "https://github.com/Ironboxplus/handfree-ssh-mcp#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "npm run build && node --test build/tests/config.test.js build/tests/command-validation.test.js build/tests/tool-error.test.js build/tests/tools.test.js build/tests/output-collector.test.js build/tests/output-log-writer.test.js build/tests/recent-fixes.test.js",
+    "test:config": "npm run build && node --test build/tests/config.test.js",
+    "test:cmd": "npm run build && node --test build/tests/command-validation.test.js",
+    "test:tools": "npm run build && node --test build/tests/tools.test.js",
+    "test:integration": "npm run build && node build/tests/integration.test.js",
+    "test:all": "npm run test && npm run test:integration",
+    "build": "node scripts/build.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "ssh",
+    "mcp",
+    "server",
+    "cli"
+  ],
+  "author": "Junki",
+  "license": "ISC",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.17.5",
+    "js-yaml": "^4.1.0",
+    "socks": "^2.8.6",
+    "ssh2": "^1.16.0",
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^22.13.10",
+    "@types/ssh2": "^1.15.5",
+    "typescript": "^5.8.2"
+  },
+  "files": [
+    "build/config/**/*",
+    "build/core/**/*",
+    "build/models/**/*",
+    "build/services/**/*",
+    "build/tools/**/*",
+    "build/utils/**/*",
+    "build/index.js"
+  ]
+}