@dalmasonto/taskflow-mcp 1.0.18 → 1.0.19

package/dist/agent-registry.js

@@ -57,8 +57,12 @@ export function registerAgent(options) {
     checkAgentLiveness();
     // Find all entries for this project path
     const entries = db.prepare('SELECT * FROM agent_registry WHERE project_path = ? ORDER BY connected_at DESC').all(projectPath);
-    // Priority 1: Reuse a disconnected entry (preserves history)
-    const disconnected = entries.find(e => e.status === 'disconnected');
+    // Priority 1: Reuse a disconnected entry that had the SAME PID (exact session resume)
+    // Priority 2: Reuse any disconnected entry for this path (new session, same project)
+    // This prevents a reconnecting agent from stealing another agent's identity
+    // when two sessions share the same project directory.
+    const disconnected = entries.find(e => e.status === 'disconnected' && e.pid === agentPid)
+        || entries.find(e => e.status === 'disconnected');
     if (disconnected) {
         const newName = options?.customName || disconnected.name;
         const renamed = newName !== disconnected.name;

package/dist/config.js

@@ -24,7 +24,14 @@ const DEFAULTS = {
     relayPushToken: '',
 };
 // ─── config file path ────────────────────────────────────────────────
-const CONFIG_PATH = resolve(homedir(), '.taskflow_config.json');
+// Config lives alongside the database in ~/.taskflow/
+// Falls back to legacy ~/.taskflow_config.json for backward compat
+import { existsSync } from 'fs';
+const NEW_CONFIG_PATH = resolve(homedir(), '.taskflow', 'config.json');
+const LEGACY_CONFIG_PATH = resolve(homedir(), '.taskflow_config.json');
+const CONFIG_PATH = existsSync(NEW_CONFIG_PATH) ? NEW_CONFIG_PATH
+    : existsSync(LEGACY_CONFIG_PATH) ? LEGACY_CONFIG_PATH
+        : NEW_CONFIG_PATH; // default to new path for fresh installs
 // ─── loader ──────────────────────────────────────────────────────────
 function loadFromFile() {
     try {

package/dist/index.js

@@ -140,8 +140,10 @@ if (!httpOnly) {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     const { registerAgent, unregisterAgent } = await import('./agent-registry.js');
-    // Auto-register this agent
+    const { setAgentName } = await import('./tools/agent-inbox.js');
+    // Auto-register this agent and sync name to agent-inbox tools
     const agentName = registerAgent();
+    setAgentName(agentName);
     const agentPid = process.ppid;
     console.error(`[agent] registered as "${agentName}"`);
     let cleanup = () => { try {

package/dist/sse.js

@@ -3,6 +3,7 @@ import { execFileSync } from 'child_process';
 import { getDb } from './db.js';
 import { logActivity } from './helpers.js';
 import { getConfig } from './config.js';
+import { validateKeys } from './tools/terminal.js';
 const SERVICE_ID = 'taskflow-mcp';
 const PROBE_TIMEOUT_MS = 2000;
 // ─── Relay upstream config (from config file, env vars, or .env) ────
@@ -53,24 +54,32 @@ function readBody(req) {
         req.on('end', () => resolve(body));
     });
 }
-const PROMPT_PATTERNS = [
-    /Esc to cancel/i,
-    /Tab to amend/i,
-    /\(y\/n\)/i,
-    /\(yes\/no\)/i,
-    /Do you want to/i,
-    /Allow .+ for this/i,
-];
+/**
+ * Detect an active Claude Code permission prompt.
+ *
+ * The definitive marker is "Esc to cancel" which only appears in the
+ * footer of active prompts and disappears once the user responds.
+ * We check only the last 10 lines of the VISIBLE screen (not full
+ * scrollback) to avoid matching old, already-answered prompts.
+ *
+ * Generic patterns like "Do you want to" and "(y/n)" are intentionally
+ * excluded — Claude writes these in prose responses too, causing false flags.
+ */
 function detectPrompt(content) {
-    const tail = content.split('\n').slice(-25).join('\n');
+    // Only check last 10 lines — the prompt footer is always at the bottom
+    const lines = content.split('\n');
+    const tail = lines.slice(-10).join('\n');
     const hints = [];
-    if (/Esc to cancel/i.test(tail))
+    const hasEsc = /Esc to cancel/i.test(tail);
+    const hasTab = /Tab to amend/i.test(tail);
+    if (hasEsc)
         hints.push('Esc to cancel');
-    if (/Tab to amend/i.test(tail))
+    if (hasTab)
         hints.push('Tab to amend');
     if (/shift\+tab/i.test(tail))
         hints.push('Shift+Tab');
-    const detected = PROMPT_PATTERNS.some(p => p.test(tail));
+    // Only flag as detected if we see the actual prompt footer
+    const detected = hasEsc || hasTab;
     return { detected, hints };
 }
 /** Fast string hash (djb2) for content change detection */
@@ -466,6 +475,10 @@ export async function startSSEServer() {
                 jsonResponse(res, 400, { error: `Agent "${agentName}" has no tmux pane` });
                 return;
             }
+            if (agent.status !== 'connected') {
+                jsonResponse(res, 403, { error: `Agent "${agentName}" is disconnected — sending keys to a bare shell is blocked for security` });
+                return;
+            }
             let body;
             try {
                 body = JSON.parse(await readBody(req));
@@ -481,6 +494,12 @@ export async function startSSEServer() {
                 jsonResponse(res, 400, { error: 'keys must be a string' });
                 return;
             }
+            // Block shell escape patterns and oversized payloads
+            const violation = validateKeys(keys);
+            if (violation) {
+                jsonResponse(res, 403, { error: violation });
+                return;
+            }
             try {
                 const pane = agent.tmux_pane;
                 if (literal) {
@@ -582,8 +601,14 @@ export async function startSSEServer() {
                             'Authorization': `Bearer ${RELAY_PUSH_TOKEN}`,
                         },
                         body: JSON.stringify({ url: localUrl }),
-                    }).then(() => {
-                        console.log(`[SSE] registered with relay at ${RELAY_URL}`);
+                    }).then(async (res) => {
+                        if (res.ok) {
+                            console.log(`[SSE] registered with relay at ${RELAY_URL}`);
+                        }
+                        else {
+                            const body = await res.text().catch(() => '');
+                            console.error(`[SSE] relay registration rejected: ${res.status} ${body}`);
+                        }
                     }).catch((err) => {
                         console.error(`[SSE] relay registration failed: ${err.message}`);
                     });

package/dist/tools/agent-inbox.d.ts

@@ -1,5 +1,10 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 /** The name assigned to this agent after registration */
 declare let myAgentName: string | null;
+/** Set the agent name from external registration (index.ts).
+ *  This prevents double-registration when index.ts registers at startup
+ *  and ensureRegistered() would register again on first tool call.
+ */
+export declare function setAgentName(name: string): void;
 export { myAgentName };
 export declare function registerAgentInboxTools(server: McpServer): void;

package/dist/tools/agent-inbox.js

@@ -4,11 +4,28 @@ import { logActivity, errorResponse, successResponse, now, broadcastChange } fro
 import { registerAgent as doRegister, getAgent, listAgents } from '../agent-registry.js';
 /** The name assigned to this agent after registration */
 let myAgentName = null;
-/** Get or auto-register the agent name */
+/** Set the agent name from external registration (index.ts).
+ *  This prevents double-registration when index.ts registers at startup
+ *  and ensureRegistered() would register again on first tool call.
+ */
+export function setAgentName(name) {
+    myAgentName = name;
+}
+/** Get or auto-register the agent name.
+ *  Verifies the cached registration is still valid — if the liveness
+ *  checker disconnected us while sleeping, re-register to reclaim identity.
+ */
 function ensureRegistered() {
-    if (!myAgentName) {
-        myAgentName = doRegister();
+    if (myAgentName) {
+        // Verify our registration is still active
+        const agent = getAgent(myAgentName);
+        if (agent && agent.status === 'connected' && agent.pid === process.ppid) {
+            return myAgentName;
+        }
+        // Stale — re-register
+        myAgentName = null;
     }
+    myAgentName = doRegister();
     return myAgentName;
 }
 export { myAgentName };

package/dist/tools/terminal.d.ts

@@ -1,2 +1,4 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** Validate keys before sending — blocks shell escape patterns */
+export declare function validateKeys(keys: string): string | null;
 export declare function registerTerminalTools(server: McpServer): void;

package/dist/tools/terminal.js

@@ -2,13 +2,34 @@ import { z } from 'zod';
 import { execFileSync } from 'child_process';
 import { getDb } from '../db.js';
 import { logActivity, errorResponse, successResponse } from '../helpers.js';
-function getAgentPane(agentName) {
+const MAX_KEYS_LENGTH = 200;
+// Patterns that should never be sent via remote key injection
+const BLOCKED_PATTERNS = [
+    /^\s*!/, // Claude Code shell escape (! command)
+    /;\s*!/, // shell escape after semicolon
+];
+/** Validate keys before sending — blocks shell escape patterns */
+export function validateKeys(keys) {
+    if (keys.length > MAX_KEYS_LENGTH) {
+        return `Keys too long (${keys.length} chars, max ${MAX_KEYS_LENGTH}) — potential injection`;
+    }
+    for (const pattern of BLOCKED_PATTERNS) {
+        if (pattern.test(keys)) {
+            return 'Blocked: shell escape pattern detected (! prefix). Use the terminal directly for shell commands.';
+        }
+    }
+    return null; // valid
+}
+function getAgentPane(agentName, requireConnected = false) {
     const db = getDb();
     const agent = db.prepare('SELECT * FROM agent_registry WHERE name = ?').get(agentName);
     if (!agent)
         return { error: errorResponse(`Agent "${agentName}" not found`, 'NOT_FOUND') };
     if (!agent.tmux_pane)
         return { error: errorResponse(`Agent "${agentName}" has no tmux pane`, 'VALIDATION_ERROR') };
+    if (requireConnected && agent.status !== 'connected') {
+        return { error: errorResponse(`Agent "${agentName}" is disconnected — sending keys to a bare shell is blocked for security`, 'VALIDATION_ERROR') };
+    }
     return { agent };
 }
 export function registerTerminalTools(server) {
@@ -36,9 +57,13 @@ export function registerTerminalTools(server) {
         enter: z.boolean().optional().describe('Whether to press Enter after the keys (default: true)'),
         literal: z.boolean().optional().describe('Send as literal text with -l flag (default: true). Set false for tmux key names like Escape, Up, Down, Left, Right, BTab'),
     }, { destructiveHint: true }, async (params) => {
-        const result = getAgentPane(params.agent_name);
+        const result = getAgentPane(params.agent_name, true);
         if (result.error)
             return result.error;
+        // Validate keys for injection attacks
+        const violation = validateKeys(params.keys);
+        if (violation)
+            return errorResponse(violation, 'VALIDATION_ERROR');
         const sendEnter = params.enter !== false;
         const isLiteral = params.literal !== false;
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dalmasonto/taskflow-mcp",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "description": "MCP server for TaskFlow — manage projects, tasks, timers, analytics via AI agents",
   "type": "module",
   "main": "dist/index.js",