@antonbabenko/deliberation-mcp 3.6.1 → 3.6.2

package/dist/index.js

@@ -283,9 +283,9 @@ var require_provider = __commonJS({
           break;
         }
       }
-      for (const ln of lines) {
-        const t = ln.replace(MD_EMPHASIS, "").trim();
-        if (TOKEN_LINE_RE.test(t)) return (
+      const nonEmpty = lines.map((l) => l.replace(MD_EMPHASIS, "").trim()).filter((t) => t !== "");
+      for (const t of [nonEmpty[0], nonEmpty[nonEmpty.length - 1]]) {
+        if (t && TOKEN_LINE_RE.test(t)) return (
           /** @type {any} */
           normVerdict(t)
         );
@@ -1118,7 +1118,7 @@ var require_sessions = __commonJS({
     var DEFAULT_MAX_AGE_DAYS = 30;
     function scrubSecrets(text) {
       if (typeof text !== "string" || text.length === 0) return text;
-      return text.replace(/\bsk-or-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bxai-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]").replace(/\bAIza[0-9A-Za-z_-]{35,}/g, "[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Bearer [REDACTED]");
+      return text.replace(/\bsk-or-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bxai-[A-Za-z0-9_-]{20,}/g, "[REDACTED]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]").replace(/\bAIza[0-9A-Za-z_-]{35,}/g, "[REDACTED]").replace(/\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:)[^\s@/]{6,}@/gi, "$1[REDACTED]@").replace(/\bToken\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Token [REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, "Bearer [REDACTED]");
     }
     function capText(text) {
       if (typeof text !== "string") return text;
@@ -2202,6 +2202,7 @@ var require_gemini = __commonJS({
     var DEFAULT_RECOVERY_GRACE_MS = 12e4;
     var MAX_MS = 6e5;
     var VALID_SANDBOX_VALUES = /* @__PURE__ */ new Set(["read-only", "workspace-write"]);
+    var THREAD_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,127}$/;
     function goDuration(ms) {
       return Math.ceil(ms / 1e3) + "s";
     }
@@ -2225,10 +2226,14 @@ ${prompt}`;
       return args;
     }
     var ADVISORY_ENV_SCRUB = ["GITHUB_TOKEN", "GH_TOKEN", "GIT_ASKPASS", "SSH_AUTH_SOCK"];
+    var CREDENTIAL_NAME_RE = /(?:^|_)(?:KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS)$|API_KEY|ACCESS_KEY|SESSION_TOKEN|PRIVATE_KEY/i;
     function advisoryEnv(env) {
       const out = { ...env };
       delete out.DELIBERATION_DISABLE_OS_SANDBOX;
       for (const k of ADVISORY_ENV_SCRUB) delete out[k];
+      for (const k of Object.keys(out)) {
+        if (CREDENTIAL_NAME_RE.test(k)) delete out[k];
+      }
       return out;
     }
     function seatbeltLiteral(p) {
@@ -2349,7 +2354,8 @@ ${prompt}`;
           real = fs.realpathSync(resolved);
         } catch (_) {
         }
-        return map[real] ?? map[resolved] ?? map[cwd] ?? null;
+        const candidate = map[real] ?? map[resolved] ?? map[cwd] ?? null;
+        return typeof candidate === "string" && THREAD_ID_RE.test(candidate) ? candidate : null;
       } catch (_) {
         return null;
       }
@@ -2674,8 +2680,8 @@ ${prompt}`;
               return;
             }
             const threadId2 = args.threadId.trim();
-            if (threadId2 === "" || threadId2 === "latest" || threadId2 === "unknown") {
-              if (shouldRespond) sendError(id, -32602, "Invalid params: 'threadId' must be an explicit conversation id, not '" + threadId2 + "'");
+            if (!THREAD_ID_RE.test(threadId2) || threadId2 === "latest" || threadId2 === "unknown") {
+              if (shouldRespond) sendError(id, -32602, "Invalid params: 'threadId' must be an explicit conversation id (alphanumeric/underscore start, then [A-Za-z0-9_-], 1..128 chars)");
               return;
             }
             if (!isNonEmptyString(args.prompt)) {
@@ -2772,6 +2778,7 @@ ${prompt}`;
       module2.exports.READ_ONLY_GUARD = READ_ONLY_GUARD;
       module2.exports.applyReadOnlyGuard = applyReadOnlyGuard;
       module2.exports.advisoryEnv = advisoryEnv;
+      module2.exports.THREAD_ID_RE = THREAD_ID_RE;
       module2.exports.buildSeatbeltProfile = buildSeatbeltProfile;
       module2.exports.buildSpawnCommand = buildSpawnCommand;
       module2.exports.diffGitState = diffGitState;
@@ -2806,7 +2813,7 @@ var require_lock = __commonJS({
         try {
           fs.mkdirSync(lockDir);
           const markerPath = path.join(lockDir, markerName);
-          fs.writeFileSync(markerPath, JSON.stringify({ pid: process.pid, token, t: Date.now() }));
+          fs.writeFileSync(markerPath, JSON.stringify({ pid: process.pid, token, t: Date.now() }), { mode: 384 });
           return { lockDir, markerPath, token };
         } catch (e) {
           if (e.code !== "EEXIST") throw e;
@@ -2900,7 +2907,7 @@ var require_cache = __commonJS({
     function writeCache(file, data) {
       mkdirSync(path.dirname(file), { recursive: true });
       const tmp = `${file}.tmp.${process.pid}.${Date.now()}`;
-      writeFileSync(tmp, JSON.stringify(data));
+      writeFileSync(tmp, JSON.stringify(data), { mode: 384 });
       renameSync(tmp, file);
     }
     var _inflight = /* @__PURE__ */ new Map();
@@ -3071,6 +3078,8 @@ var require_glob = __commonJS({
             if (!matches(includeRes, relPosix)) continue;
             files.push({ rel: relPosix, abs: realTarget, size: st.size });
             totalBytes += st.size;
+            if (files.length > maxFiles) throw new Error(`directory expansion exceeded maxFiles=${maxFiles}. Narrow include or raise the limit.`);
+            if (totalBytes > maxBytes) throw new Error(`directory expansion exceeded maxBytes=${maxBytes} bytes. Narrow include or raise the limit.`);
           } else if (ent.isDirectory()) {
             if (matches(excludeRes, relPosix) || matches(excludeRes, relPosix + "/**")) continue;
             descend(absChild, relPosix);
@@ -3085,6 +3094,8 @@ var require_glob = __commonJS({
             }
             files.push({ rel: relPosix, abs: absChild, size: st.size });
             totalBytes += st.size;
+            if (files.length > maxFiles) throw new Error(`directory expansion exceeded maxFiles=${maxFiles}. Narrow include or raise the limit.`);
+            if (totalBytes > maxBytes) throw new Error(`directory expansion exceeded maxBytes=${maxBytes} bytes. Narrow include or raise the limit.`);
           }
         }
       }
@@ -3409,7 +3420,8 @@ ${ref.inline_text}` });
           res = await f(`${base}/files`, {
             method: "POST",
             headers: { "Authorization": `Bearer ${apiKey}` },
-            body: form
+            body: form,
+            redirect: "error"
           });
         } catch (err) {
           const e = new Error(`File upload network error: ${err && err.message || err}`);
@@ -3599,7 +3611,8 @@ ${ref.inline_text}` });
             "Authorization": `Bearer ${apiKey}`
           },
           body: JSON.stringify(payload),
-          signal: controller.signal
+          signal: controller.signal,
+          redirect: "error"
         });
       } catch (err) {
         const name = err && err.name;
@@ -4326,7 +4339,7 @@ var require_openrouter = __commonJS({
       const timer = setTimeout(() => controller.abort(), t);
       let res;
       try {
-        res = await f(url, { method: "POST", headers, body: JSON.stringify(payload), signal: controller.signal });
+        res = await f(url, { method: "POST", headers, body: JSON.stringify(payload), signal: controller.signal, redirect: "error" });
       } catch (err) {
         const msg = String(err && err.message || err);
         if (err && err.name === "AbortError" || /abort/i.test(msg)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antonbabenko/deliberation-mcp",
-  "version": "3.6.1",
+  "version": "3.6.2",
   "description": "Deliberation for Claude Code and any MCP host - GPT, Gemini, Grok, and OpenRouter expert subagents.",
   "mcpName": "io.github.antonbabenko/deliberation",
   "repository": { "type": "git", "url": "git+https://github.com/antonbabenko/deliberation.git", "directory": "server/mcp" },