@baitong-dev/bash-mcp 0.0.2 → 0.0.3

package/dist/index.d.ts

@@ -1,2 +1,9 @@
 #!/usr/bin/env bun
-export {};
+/**
+ * Environment variables to inherit by default, if an environment is not explicitly given.
+ */
+export declare const DEFAULT_INHERITED_ENV_VARS: string[];
+/**
+ * Returns a default environment object including only environment variables deemed safe to inherit.
+ */
+export declare function getDefaultEnvs(): {};

package/dist/index.js

@@ -4,8 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_INHERITED_ENV_VARS = void 0;
+exports.getDefaultEnvs = getDefaultEnvs;
 /**
- * Bash MCP Server v1.0
+ * Bash MCP Server
  */
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
@@ -20,7 +22,7 @@ const child_process_1 = require("child_process");
 const bash_txt_1 = __importDefault(require("../bash.txt"));
 const mcp_helpers_1 = require("@baitong-dev/mcp-helpers");
 const MCP_NAME = 'Bash MCP';
-const MCP_VERSION = '0.0.1';
+const MCP_VERSION = '0.0.3';
 const parser = (0, mcp_helpers_1.lazy)(async () => {
     const treePath = (0, mcp_helpers_1.resolveWasm)(web_tree_sitter_wasm_1.default);
     await web_tree_sitter_1.Parser.init({
@@ -81,13 +83,6 @@ const SUDO_REJECTION_MESSAGE = '[REJECTED] sudo commands cannot be executed. Ple
 // Default max_output
 const DEFAULT_MAX_OUTPUT = 30000;
 const DEFAULT_TIMEOUT_MS = 2 * 60 * 1000;
-// Environment variables that cannot be overridden (hardened mode only)
-const PROTECTED_ENV_VARS = new Set([
-    'LD_PRELOAD',
-    'LD_LIBRARY_PATH',
-    'DYLD_INSERT_LIBRARIES',
-    'DYLD_LIBRARY_PATH'
-]);
 /**
  * Check if a command contains sudo
  * Matches: sudo at start, after semicolon, after &&, after ||, after |, after $(, after backtick
@@ -97,23 +92,43 @@ function containsSudo(command) {
     return /(?:^|[;&|`$()]\s*)sudo(?:\s|$)/m.test(command);
 }
 /**
- * Filter out protected environment variables that could be used for injection.
- * Only active in hardened mode. Passes everything through when hardened mode is off.
+ * Environment variables to inherit by default, if an environment is not explicitly given.
  */
-function filterEnvVars(env) {
-    if (!env)
-        return { filtered: undefined, rejected: [] };
-    const rejected = [];
-    const filtered = {};
-    for (const [key, value] of Object.entries(env)) {
-        if (PROTECTED_ENV_VARS.has(key.toUpperCase())) {
-            rejected.push(key);
+exports.DEFAULT_INHERITED_ENV_VARS = process.platform === 'win32'
+    ? [
+        'APPDATA',
+        'HOMEDRIVE',
+        'HOMEPATH',
+        'LOCALAPPDATA',
+        'PATH',
+        'PROCESSOR_ARCHITECTURE',
+        'SYSTEMDRIVE',
+        'SYSTEMROOT',
+        'TEMP',
+        'TMPDIR',
+        'USERNAME',
+        'USERPROFILE',
+        'PROGRAMFILES'
+    ]
+    : /* list inspired by the default env inheritance of sudo */
+        ['HOME', 'LOGNAME', 'PATH', 'SHELL', 'TERM', 'USER'];
+/**
+ * Returns a default environment object including only environment variables deemed safe to inherit.
+ */
+function getDefaultEnvs() {
+    const env = {};
+    for (const key of exports.DEFAULT_INHERITED_ENV_VARS) {
+        const value = process.env[key];
+        if (value === undefined) {
+            continue;
         }
-        else {
-            filtered[key] = value;
+        if (value.startsWith('()')) {
+            // Skip functions, which are a security risk.
+            continue;
         }
+        env[key] = value;
     }
-    return { filtered: Object.keys(filtered).length > 0 ? filtered : undefined, rejected };
+    return env;
 }
 /**
  * Middle-truncate output to preserve beginning and end
@@ -192,7 +207,6 @@ async function executeBash(options) {
     const cwd = options.cwd || DEFAULT_CWD;
     const timeout = options.timeout || DEFAULT_TIMEOUT_MS;
     const maxOutput = options.maxOutput || DEFAULT_MAX_OUTPUT;
-    const { filtered: safeEnv, rejected: rejectedVars } = filterEnvVars(options.env);
     if (containsSudo(command)) {
         throw Error(`${SUDO_REJECTION_MESSAGE}$ ${command}`);
     }
@@ -265,9 +279,8 @@ async function executeBash(options) {
         }
     }
     const mergedEnv = {
-        ...process.env,
-        ...safeEnv,
-        ...(0, mcp_helpers_1.getBinaryEnvs)()
+        ...getDefaultEnvs(),
+        ...(0, mcp_helpers_1.getBundledBinaryEnvs)()
     };
     const proc = (0, child_process_1.spawn)(command, {
         shell: getBashPath(),
@@ -309,9 +322,6 @@ async function executeBash(options) {
     if (timedOut) {
         resultMetadata.push(`bash tool terminated command after exceeding timeout ${timeout} ms`);
     }
-    if (rejectedVars.length > 0) {
-        resultMetadata.push(`bash tool blocked env vars: ${rejectedVars.join(', ')}`);
-    }
     if (resultMetadata.length > 0) {
         output += '\n\n<bash_metadata>\n' + resultMetadata.join('\n') + '\n</bash_metadata>';
     }
@@ -322,9 +332,13 @@ async function executeBash(options) {
     };
 }
 server.registerTool('bash', {
-    description: bash_txt_1.default.replaceAll('${directory}', DEFAULT_CWD)
-        .replaceAll('${maxLines}', String(2000))
-        .replaceAll('${maxBytes}', String(50 * 1024)),
+    description: JSON.stringify({
+        ...getDefaultEnvs(),
+        ...(0, mcp_helpers_1.getBundledBinaryEnvs)()
+    }, null, 2) +
+        bash_txt_1.default.replaceAll('${directory}', DEFAULT_CWD)
+            .replaceAll('${maxLines}', String(2000))
+            .replaceAll('${maxBytes}', String(50 * 1024)),
     inputSchema: bashInputSchema
 }, async (args) => {
     try {

package/dist/src/index.d.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env bun
+/**
+ * Environment variables to inherit by default, if an environment is not explicitly given.
+ */
+export declare const DEFAULT_INHERITED_ENV_VARS: string[];
+/**
+ * Returns a default environment object including only environment variables deemed safe to inherit.
+ */
+export declare function getDefaultEnvs(): {};

package/dist/src/index.js

@@ -0,0 +1,364 @@
+#!/usr/bin/env bun
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_INHERITED_ENV_VARS = void 0;
+exports.getDefaultEnvs = getDefaultEnvs;
+/**
+ * Bash MCP Server v1.0
+ */
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
+const path_1 = __importDefault(require("path"));
+const zod_1 = __importDefault(require("zod"));
+const web_tree_sitter_1 = require("web-tree-sitter");
+// @ts-ignore wasm
+const web_tree_sitter_wasm_1 = __importDefault(require("web-tree-sitter/web-tree-sitter.wasm"));
+// @ts-ignore wasm
+const tree_sitter_bash_wasm_1 = __importDefault(require("tree-sitter-bash/tree-sitter-bash.wasm"));
+const child_process_1 = require("child_process");
+const bash_txt_1 = __importDefault(require("../bash.txt"));
+const mcp_helpers_1 = require("@baitong-dev/mcp-helpers");
+const package_json_1 = __importDefault(require("../package.json"));
+const MCP_NAME = 'Bash MCP';
+const MCP_VERSION = package_json_1.default.version;
+const parser = (0, mcp_helpers_1.lazy)(async () => {
+    const treePath = (0, mcp_helpers_1.resolveWasm)(web_tree_sitter_wasm_1.default);
+    await web_tree_sitter_1.Parser.init({
+        locateFile() {
+            return treePath;
+        }
+    });
+    const bashPath = (0, mcp_helpers_1.resolveWasm)(tree_sitter_bash_wasm_1.default);
+    const bashLanguage = await web_tree_sitter_1.Language.load(bashPath);
+    const p = new web_tree_sitter_1.Parser();
+    p.setLanguage(bashLanguage);
+    return p;
+});
+/**
+ * Get the path to the bash executable
+ * @returns The path to the bash executable
+ */
+const getBashPath = (0, mcp_helpers_1.lazy)(() => {
+    const shell = process.env.SHELL;
+    if (shell)
+        return shell;
+    // Fallback: check common Git Bash paths directly
+    if (process.platform === 'win32') {
+        const bash = (0, mcp_helpers_1.findGitBash)((0, mcp_helpers_1.getBundledBinaryPath)('bash'));
+        if (bash)
+            return bash;
+        throw new Error('Git Bash not found');
+        // return process.env.COMSPEC || "cmd.exe"
+    }
+    if (process.platform === 'darwin')
+        return '/bin/zsh';
+    const bash = Bun.which('bash');
+    if (bash)
+        return bash;
+    return '/bin/sh';
+});
+const server = new mcp_js_1.McpServer({
+    name: MCP_NAME,
+    version: MCP_VERSION
+}, {
+    capabilities: {
+        logging: {}
+    }
+});
+// =============================================================================
+// Constants
+// =============================================================================
+// Default working directory
+const DEFAULT_CWD = path_1.default.join(mcp_helpers_1.MCP_HOME_DIR, 'workspace');
+// Grace period before SIGKILL (ms)
+const SIGKILL_TIMEOUT_MS = 5000;
+// Reserved characters for truncation ellipsis
+const TRUNCATION_ELLIPSIS_RESERVE = 50;
+// Exit code for timeout (shell convention)
+const EXIT_CODE_TIMEOUT = 124;
+// Sudo rejection message
+const SUDO_REJECTION_MESSAGE = '[REJECTED] sudo commands cannot be executed. Please STOP and ask human user to run it for you!\n';
+// Default max_output
+const DEFAULT_MAX_OUTPUT = 30000;
+const DEFAULT_TIMEOUT_MS = 2 * 60 * 1000;
+/**
+ * Check if a command contains sudo
+ * Matches: sudo at start, after semicolon, after &&, after ||, after |, after $(, after backtick
+ */
+function containsSudo(command) {
+    // Match sudo as a standalone command (not part of another word like "pseudocode")
+    return /(?:^|[;&|`$()]\s*)sudo(?:\s|$)/m.test(command);
+}
+/**
+ * Environment variables to inherit by default, if an environment is not explicitly given.
+ */
+exports.DEFAULT_INHERITED_ENV_VARS = process.platform === 'win32'
+    ? [
+        'APPDATA',
+        'HOMEDRIVE',
+        'HOMEPATH',
+        'LOCALAPPDATA',
+        'PATH',
+        'PROCESSOR_ARCHITECTURE',
+        'SYSTEMDRIVE',
+        'SYSTEMROOT',
+        'TEMP',
+        'TMPDIR',
+        'USERNAME',
+        'USERPROFILE',
+        'PROGRAMFILES'
+    ]
+    : /* list inspired by the default env inheritance of sudo */
+        ['HOME', 'LOGNAME', 'PATH', 'SHELL', 'TERM', 'USER'];
+/**
+ * Returns a default environment object including only environment variables deemed safe to inherit.
+ */
+function getDefaultEnvs() {
+    const env = {};
+    for (const key of exports.DEFAULT_INHERITED_ENV_VARS) {
+        const value = process.env[key];
+        if (value === undefined) {
+            continue;
+        }
+        if (value.startsWith('()')) {
+            // Skip functions, which are a security risk.
+            continue;
+        }
+        env[key] = value;
+    }
+    return env;
+}
+/**
+ * Middle-truncate output to preserve beginning and end
+ */
+function middleTruncate(text, maxLength) {
+    if (text.length <= maxLength)
+        return text;
+    const halfLength = Math.floor((maxLength - TRUNCATION_ELLIPSIS_RESERVE) / 2);
+    const start = text.slice(0, halfLength);
+    const end = text.slice(-halfLength);
+    const truncatedBytes = text.length - maxLength;
+    return `${start}\n\n... [truncated ${truncatedBytes} characters] ...\n\n${end}`;
+}
+// =============================================================================
+// Tool Definitions
+// =============================================================================
+const bashInputSchema = zod_1.default.object({
+    command: zod_1.default.string().min(1).describe('The command to execute'),
+    cwd: zod_1.default
+        .string()
+        .optional()
+        .describe(`The working directory to run the command in. Must be in ${DEFAULT_CWD}. Defaults to ${DEFAULT_CWD}. Use this instead of 'cd' commands.`), // 需要在DEFAULT_CWD下
+    timeout: zod_1.default
+        .number()
+        .min(1)
+        .max(600000)
+        .optional()
+        .describe(`Timeout in milliseconds (optional, default ${DEFAULT_TIMEOUT_MS}, max 600000)`),
+    description: zod_1.default
+        .string()
+        .optional()
+        .describe('Clear, concise description of what this command does in 5-10 words. Examples:\nInput: ls\nOutput: Lists files in current directory\n\nInput: git status\nOutput: Shows working tree status\n\nInput: npm install\nOutput: Installs package dependencies\n\nInput: mkdir foo\nOutput: Creates directory "foo"'),
+    env: zod_1.default
+        .record(zod_1.default.string(), zod_1.default.string())
+        .optional()
+        .describe('Additional environment variables to set'),
+    maxOutput: zod_1.default
+        .number()
+        .min(1)
+        .max(1000000)
+        .optional()
+        .describe(`Maximum output length before middle-truncation (default ${DEFAULT_MAX_OUTPUT})`)
+});
+async function killTree(proc, opts) {
+    const pid = proc.pid;
+    if (!pid || opts?.exited?.())
+        return;
+    if (process.platform === 'win32') {
+        await new Promise(resolve => {
+            const killer = (0, child_process_1.spawn)('taskkill', ['/pid', String(pid), '/f', '/t'], { stdio: 'ignore' });
+            killer.once('exit', () => resolve());
+            killer.once('error', () => resolve());
+        });
+        return;
+    }
+    try {
+        process.kill(-pid, 'SIGTERM');
+        await Bun.sleep(SIGKILL_TIMEOUT_MS);
+        if (!opts?.exited?.()) {
+            process.kill(-pid, 'SIGKILL');
+        }
+    }
+    catch (_e) {
+        proc.kill('SIGTERM');
+        await Bun.sleep(SIGKILL_TIMEOUT_MS);
+        if (!opts?.exited?.()) {
+            proc.kill('SIGKILL');
+        }
+    }
+}
+/**
+ * Execute a bash command and return result
+ */
+async function executeBash(options) {
+    const command = options.command.trim();
+    const cwd = options.cwd || DEFAULT_CWD;
+    const timeout = options.timeout || DEFAULT_TIMEOUT_MS;
+    const maxOutput = options.maxOutput || DEFAULT_MAX_OUTPUT;
+    if (containsSudo(command)) {
+        throw Error(`${SUDO_REJECTION_MESSAGE}$ ${command}`);
+    }
+    if (!(0, mcp_helpers_1.isSubdirectory)(DEFAULT_CWD, cwd, {
+        includeSelf: true
+    })) {
+        throw Error(`"${cwd}" must be in ${DEFAULT_CWD}`);
+    }
+    if (!(await (0, mcp_helpers_1.isDir)(cwd))) {
+        throw Error(`"${cwd}" must be a directory`);
+    }
+    const tree = await parser().then(p => p.parse(command));
+    if (!tree) {
+        throw new Error('Failed to parse command');
+    }
+    const directories = new Set();
+    // if (!Instance.containsPath(cwd)) directories.add(cwd)
+    const patterns = new Set();
+    // const always = new Set<string>()
+    let output = '';
+    for (const node of tree.rootNode.descendantsOfType('command')) {
+        if (!node)
+            continue;
+        // Get full command text including redirects if present
+        let commandText = node.parent?.type === 'redirected_statement' ? node.parent.text : node.text;
+        const commands = [];
+        for (let i = 0; i < node.childCount; i++) {
+            const child = node.child(i);
+            if (!child)
+                continue;
+            if (child.type !== 'command_name' &&
+                child.type !== 'word' &&
+                child.type !== 'string' &&
+                child.type !== 'raw_string' &&
+                child.type !== 'concatenation') {
+                continue;
+            }
+            commands.push(child.text);
+        }
+        // not an exhaustive list, but covers most common cases
+        if (['cd', 'rm', 'cp', 'mv', 'mkdir', 'touch', 'chmod', 'chown', 'cat'].includes(commands[0])) {
+            for (const arg of commands.slice(1)) {
+                if (arg.startsWith('-') || (commands[0] === 'chmod' && arg.startsWith('+'))) {
+                    continue;
+                }
+                const resolved = await Bun.$ `realpath ${arg}`
+                    .cwd(cwd)
+                    .quiet()
+                    .nothrow()
+                    .text()
+                    .then(x => x.trim());
+                if (resolved) {
+                    // Git Bash on Windows returns Unix-style paths like /c/Users/...
+                    const normalized = process.platform === 'win32' && resolved.match(/^\/[a-z]\//)
+                        ? (0, mcp_helpers_1.gitBashToWindowsPath)(resolved)
+                        : resolved;
+                    if (!(0, mcp_helpers_1.isSubdirectory)(DEFAULT_CWD, normalized, { includeSelf: true })) {
+                        const dir = (await (0, mcp_helpers_1.isDir)(normalized)) ? normalized : path_1.default.dirname(normalized);
+                        directories.add(dir);
+                    }
+                }
+            }
+        }
+        else {
+        }
+        // cd covered by above check
+        if (commands.length && commands[0] !== 'cd') {
+            patterns.add(commandText);
+            // always.add(BashArity.prefix(command).join(' ') + ' *')
+        }
+    }
+    const mergedEnv = {
+        ...getDefaultEnvs(),
+        ...(0, mcp_helpers_1.getBundledBinaryEnvs)()
+    };
+    const proc = (0, child_process_1.spawn)(command, {
+        shell: getBashPath(),
+        cwd,
+        env: {
+            ...mergedEnv
+        },
+        stdio: ['ignore', 'pipe', 'pipe'],
+        detached: process.platform !== 'win32'
+    });
+    const append = (chunk) => {
+        output += chunk.toString();
+    };
+    proc.stdout?.on('data', append);
+    proc.stderr?.on('data', append);
+    let timedOut = false;
+    let exited = false;
+    const kill = () => killTree(proc, { exited: () => exited });
+    const timeoutTimer = setTimeout(() => {
+        timedOut = true;
+        void kill();
+    }, timeout + 100);
+    await new Promise((resolve, reject) => {
+        const cleanup = () => {
+            clearTimeout(timeoutTimer);
+        };
+        proc.once('exit', () => {
+            exited = true;
+            cleanup();
+            resolve();
+        });
+        proc.once('error', error => {
+            exited = true;
+            cleanup();
+            reject(error);
+        });
+    });
+    const resultMetadata = [];
+    if (timedOut) {
+        resultMetadata.push(`bash tool terminated command after exceeding timeout ${timeout} ms`);
+    }
+    if (resultMetadata.length > 0) {
+        output += '\n\n<bash_metadata>\n' + resultMetadata.join('\n') + '\n</bash_metadata>';
+    }
+    return {
+        output: middleTruncate(output, maxOutput),
+        exitCode: proc.exitCode,
+        description: options.description
+    };
+}
+server.registerTool('bash', {
+    description: JSON.stringify({
+        ...getDefaultEnvs(),
+        ...(0, mcp_helpers_1.getBundledBinaryEnvs)()
+    }, null, 2) +
+        bash_txt_1.default.replaceAll('${directory}', DEFAULT_CWD)
+            .replaceAll('${maxLines}', String(2000))
+            .replaceAll('${maxBytes}', String(50 * 1024)),
+    inputSchema: bashInputSchema
+}, async (args) => {
+    try {
+        const result = await executeBash({ ...args });
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result) }],
+            structuredContent: result
+        };
+    }
+    catch (error) {
+        return {
+            isError: true,
+            content: [{ type: 'text', text: error instanceof Error ? error.message : String(error) }]
+        };
+    }
+});
+// =============================================================================
+// Start Server
+// =============================================================================
+const transport = new stdio_js_1.StdioServerTransport();
+server.connect(transport);
+console.error(`${MCP_NAME} Server v${MCP_VERSION} running`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baitong-dev/bash-mcp",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "main": "./dist/index.js",
   "bin": {
     "@baitong-dev/bash-mcp": "./dist/index.js"
@@ -20,7 +20,10 @@
     "tree-sitter-bash": "^0.25.1",
     "web-tree-sitter": "^0.26.5",
     "zod": "^4.3.4",
-    "@baitong-dev/mcp-helpers": "0.0.1"
+    "@baitong-dev/mcp-helpers": "0.0.2"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.2"
   },
   "publishConfig": {
     "access": "public",