@cloudgrid-io/mcp 0.21.0 → 0.21.1

package/README.md

@@ -197,16 +197,16 @@ recording whether the user agreed to share the conversation (`deploy.js:544`),
 and a `context` object the model supplies — which by its declared shape
 (`register.js:964-975`) can carry the failing inputs (for example the HTML or
 args) and the original request. The transcript itself is not sent by this tool.
-The report scrub is **key-name-only**: a value is redacted only when its *key*
-matches a secret-looking name (`password`, `token`, `api_key`, …), so a secret
-embedded in a value — for example an API key inside HTML sent under
-`context.inputs` — is not redacted, and the error summary (`message`) is not
-scrubbed at all. This same key-name filter is applied client-side
-(`deploy.js:439-448`); the platform's error endpoint applies a key-name filter
-too, not a value-based one, so neither layer catches a secret that sits in a
-value. To keep a secret out of a report, do not place it in the `message` or
-`context` you send, or set `CLOUDGRID_TELEMETRY=off` to disable reporting
-entirely.
+The report scrub is **two-layer**: values AND the `message` field are scanned
+for known secret shapes (API key prefixes such as `sk-ant-`, `sk-proj-`,
+`AKIA…`; JWTs; PEM private-key blocks; Bearer tokens; basic-auth URL
+credentials) and matches are replaced with `[REDACTED]`. Arbitrary or
+unknown-shape secrets that do not match a known pattern still transit
+unredacted. The client-side scrub (`scrubReportContext` + `scrubSecretValues`
+in deploy.js) runs before the POST; the server endpoint applies a server-side
+key-name filter on top. To keep a secret out of a report, do not place it in
+the `message` or `context` you send, or set `CLOUDGRID_TELEMETRY=off` to
+disable reporting entirely.
 
 **Version check.** At startup the local edition makes one request to
 `https://registry.npmjs.org/@cloudgrid-io/mcp/latest` to detect a stale `.mcpb`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {

package/src/tools/deploy.js

@@ -43,6 +43,22 @@ function isProvisioningCode(code) {
   return PROVISIONING_CODES.has(code);
 }
 
+// Same org->grid rename, same dual-accept safety (cloudgrid-io/cloudgrid#2673).
+// These two codes gate the first-time-user "no grid" path and the wrong-grid
+// path — if the MCP recognizes only the old ORG_* spelling, the API renaming it
+// silently darks those paths (the account-has-no-grid guidance and the typo
+// hint stop firing). NO_ACTIVE_GRID is ALREADY emitted by the API alongside
+// NO_ACTIVE_ORG; GRID_NOT_ACCESSIBLE is the anticipated rename of
+// ORG_NOT_ACCESSIBLE. Accept both spellings so the API rename can land anytime.
+const NO_ACTIVE_GRID_CODES = new Set(["NO_ACTIVE_GRID", "NO_ACTIVE_ORG"]);
+function isNoActiveGridCode(code) {
+  return NO_ACTIVE_GRID_CODES.has(code);
+}
+const GRID_NOT_ACCESSIBLE_CODES = new Set(["GRID_NOT_ACCESSIBLE", "ORG_NOT_ACCESSIBLE"]);
+function isGridNotAccessibleCode(code) {
+  return GRID_NOT_ACCESSIBLE_CODES.has(code);
+}
+
 
 // ── Org listing (bearer-authed, web edition) ──────────────────────────────────
 // Fetches the signed-in user's orgs via GET /api/v2/orgs. The JWT does not
@@ -480,13 +496,51 @@ const REPORT_SECRET_KEY_PATTERNS = [
   /access[_-]?key/i,
 ];
 
-// Light client-side scrub of obviously secret-looking values in the report
-// context. Redacts values under secret-looking KEYS; leaves everything else
-// intact (the server applies the same key-name filter, not a value-based one —
-// a secret embedded in a value transits unredacted). Bounded depth so a
-// pathological object can't loop.
+// Value-level secret patterns — must stay in sync with TEXT_SECRET_PATTERNS
+// in session-logger.js (which scrubs free text for session logs). The lists are
+// separate because this module operates on structured object values via
+// scrubReportContext, while session-logger operates on free text via scrubText.
+// Both scan string content for the same secret shapes; if you add a pattern to
+// one, add it to the other.
+const REPORT_SECRET_VALUE_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{0,}/g,
+  /sk-ant-[A-Za-z0-9_-]{16,}/g,
+  /sk-or-v1-[A-Za-z0-9]{16,}/g,
+  /sk-proj-[A-Za-z0-9_-]{16,}/g,
+  /\bsk-[A-Za-z0-9]{20,}/g,
+  /AIza[0-9A-Za-z_-]{30,}/g,
+  /ghp_[A-Za-z0-9]{30,}/g,
+  /github_pat_[A-Za-z0-9_]{30,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /\bsk_(?:live|test)_[0-9A-Za-z]{16,}\b/g,
+  /\bBearer\s+[A-Za-z0-9._-]{8,}/gi,
+];
+
+// Replace known secret shapes inside a string value with [REDACTED].
+// Complementary to the key-name check in scrubReportContext — this catches
+// secrets that live inside values (e.g. an API key pasted into HTML source).
+function scrubSecretValues(str) {
+  if (typeof str !== "string") return str;
+  let out = str;
+  for (const re of REPORT_SECRET_VALUE_PATTERNS) {
+    out = out.replace(re, "[REDACTED]");
+  }
+  out = out.replace(/([a-zA-Z][a-zA-Z0-9+.\-]*:\/\/)[^\s:@/]+:[^\s:@/]+@/g, "$1[REDACTED]@");
+  return out;
+}
+
+// Client-side scrub of the report context. Two layers:
+//   1. Key-name check: values under secret-looking KEYS are fully redacted.
+//   2. Value scan: string values in the tree (up to depth 5) are scanned for known
+//      secret shapes (API keys, Bearer tokens) and matches are replaced.
+// Bounded depth so a pathological object can't loop.
 export function scrubReportContext(obj, depth = 0) {
-  if (depth > 5 || obj === null || typeof obj !== "object") return obj;
+  if (depth > 5 || obj === null || typeof obj !== "object") {
+    // Leaf value — scrub known secret shapes from strings.
+    return typeof obj === "string" ? scrubSecretValues(obj) : obj;
+  }
   if (Array.isArray(obj)) return obj.map((item) => scrubReportContext(item, depth + 1));
   const out = {};
   for (const [key, value] of Object.entries(obj)) {
@@ -575,11 +629,11 @@ export async function runReport(
     // category: default "mcp" (or the failing tool name the agent passes).
     category: typeof category === "string" && category.trim() ? category.trim() : "mcp",
     app: "mcp",
-    message: summary.slice(0, 5000),
+    message: scrubSecretValues(summary).slice(0, 5000),
     context: safeContext,
     // Diagnostic pivots (match the CLI) — only when the agent forwards them.
     ...(typeof trace_id === "string" && trace_id ? { trace_id } : {}),
-    ...(typeof failed_step === "string" && failed_step ? { failed_step } : {}),
+    ...(typeof failed_step === "string" && failed_step ? { failed_step: scrubSecretValues(failed_step) } : {}),
     ...(typeof http_status === "number" && Number.isFinite(http_status) ? { http_status } : {}),
     // Attribution, ALSO top-level (persisted once the handler accepts these keys;
     // context.origin is the fallback until then).
@@ -750,22 +804,23 @@ export async function runPull(ctx, { claim_token, claim_url, entity_id, grid } =
       };
     }
     const code = data?.error?.code || null;
-    // ORG_NOT_ACCESSIBLE: the `grid` param has a typo or the user isn't a
-    // member of that grid. The server message already contains an "Available:"
-    // hint listing valid grid slugs — surface it so the agent can self-correct.
-    if (code === "ORG_NOT_ACCESSIBLE") {
+    // ORG_NOT_ACCESSIBLE / GRID_NOT_ACCESSIBLE: the `grid` param has a typo or
+    // the user isn't a member of that grid. The server message already contains
+    // an "Available:" hint listing valid grid slugs — surface it so the agent
+    // can self-correct.
+    if (isGridNotAccessibleCode(code)) {
       const serverMsg = data?.error?.message || "The specified grid is not accessible.";
       const hint = data?.error?.details?.[0]?.hint || "";
       return {
         text:
           `${serverMsg}${hint ? ` ${hint}` : ""} ` +
           `Check the grid slug for typos and retry grid_pull with the correct \`grid\` parameter.`,
-        structured: { error: { code: "ORG_NOT_ACCESSIBLE" } },
+        structured: { error: { code } },
       };
     }
-    // NO_ACTIVE_ORG: the account has no grid at all — route to in-flow grid
-    // creation instead of the misleading "no push access" advice.
-    if (code === "NO_ACTIVE_ORG") {
+    // NO_ACTIVE_ORG / NO_ACTIVE_GRID: the account has no grid at all — route to
+    // in-flow grid creation instead of the misleading "no push access" advice.
+    if (isNoActiveGridCode(code)) {
       return {
         text:
           "The account has no grid yet. Do not send the user to the console — create one from here: " +
@@ -1346,10 +1401,10 @@ export function errorGuidance({ status, code, edition, isEdit, isAnon, signedIn
       : "Your sign-in is missing or expired. Run grid_login, then retry the same grid_plug. Do not offer anonymous publishing as a fix for a failed sign-in; anonymous is only for a user who explicitly asks to publish without attribution.";
   }
   if (status === 403) {
-    // NO_ACTIVE_ORG is not a role problem — the account has no grid at all.
-    // The generic pull/pickup hint here sent a first-time user in circles
-    // (field bug 2026-07-27); route them to in-flow grid creation instead.
-    if (code === "NO_ACTIVE_ORG") {
+    // NO_ACTIVE_ORG / NO_ACTIVE_GRID is not a role problem — the account has no
+    // grid at all. The generic pull/pickup hint here sent a first-time user in
+    // circles (field bug 2026-07-27); route them to in-flow grid creation instead.
+    if (isNoActiveGridCode(code)) {
       return "The account has no grid yet. Do not send the user to the console — create one from here: suggest a short slug, confirm it with the user, call grid_create_grid, then re-call grid_plug with grid: <slug>.";
     }
     return "You lack the role to plug this target. To get push access to the SAME entity, use `grid_collab` — it grants permission only and fetches nothing, so run `grid_pull` again once it is granted (if the owner gates access, it becomes a request they approve). To make your own separate copy (a fork), use `grid_pickup`.";