@ductape/mcp 0.2.9 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.9
+
+- Security: execute `ductape_cli` with an argument array and no shell, reject shell operators/substitutions, and validate quoted command input before checking the administrative subcommand allowlist.
+
 ## Unreleased
 
 - Broadened Feature guidance from durable/event-driven workflows to synchronous or asynchronous named product capabilities.

package/dist/cli-command.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Parse the user-facing command string into an argv array without invoking a shell.
+ * Supports ordinary single/double quoting and backslash escaping for paths/values.
+ */
+export declare function parseCliCommand(command: string): string[];
+//# sourceMappingURL=cli-command.d.ts.map

package/dist/cli-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-command.d.ts","sourceRoot":"","sources":["../src/cli-command.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAmDzD"}

package/dist/cli-command.js

@@ -0,0 +1,66 @@
+/** Characters with shell control/expansion meaning are never valid in ductape_cli input. */
+const SHELL_META = /[;&|`$<>()\r\n\0]/;
+/**
+ * Parse the user-facing command string into an argv array without invoking a shell.
+ * Supports ordinary single/double quoting and backslash escaping for paths/values.
+ */
+export function parseCliCommand(command) {
+    if (typeof command !== 'string' || command.trim() === '') {
+        throw new Error('A non-empty Ductape CLI command is required.');
+    }
+    if (SHELL_META.test(command)) {
+        throw new Error('Shell operators, substitutions, redirects, and control characters are not allowed.');
+    }
+    const argv = [];
+    let token = '';
+    let quote = null;
+    let tokenStarted = false;
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index];
+        if (quote) {
+            if (char === quote) {
+                quote = null;
+            }
+            else if (char === '\\' && quote === '"') {
+                index += 1;
+                if (index >= command.length)
+                    throw new Error('Trailing escape in Ductape CLI command.');
+                token += command[index];
+            }
+            else {
+                token += char;
+            }
+            tokenStarted = true;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            tokenStarted = true;
+        }
+        else if (char === '\\') {
+            index += 1;
+            if (index >= command.length)
+                throw new Error('Trailing escape in Ductape CLI command.');
+            token += command[index];
+            tokenStarted = true;
+        }
+        else if (/\s/.test(char)) {
+            if (tokenStarted) {
+                argv.push(token);
+                token = '';
+                tokenStarted = false;
+            }
+        }
+        else {
+            token += char;
+            tokenStarted = true;
+        }
+    }
+    if (quote)
+        throw new Error('Unterminated quote in Ductape CLI command.');
+    if (tokenStarted)
+        argv.push(token);
+    if (argv.length === 0)
+        throw new Error('A non-empty Ductape CLI command is required.');
+    return argv;
+}

package/dist/index.js

@@ -10,7 +10,8 @@
  * the env var when provided.
  */
 import { createRequire } from 'module';
-import { execFileSync, execSync } from 'child_process';
+import { execFileSync } from 'child_process';
+import { parseCliCommand } from './cli-command.js';
 import { homedir } from 'os';
 import { delimiter, join } from 'path';
 import { z } from 'zod';
@@ -1250,7 +1251,8 @@ const ADMIN_SUBCOMMANDS = [
 ];
 function checkCli() {
     try {
-        const out = execSync('ductape --version', {
+        const out = execFileSync('ductape', ['--version'], {
+            shell: false,
             encoding: 'utf8',
             timeout: 15000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -1272,7 +1274,8 @@ function checkLoginState() {
         // `ductape whoami` only reports whether a local credentials file exists. It does not validate
         // the stored token, so an expired token would be cached as authenticated and fail later with 401.
         // Use a harmless authenticated read to validate the credential against the API.
-        execSync('ductape workspaces list --json', {
+        execFileSync('ductape', ['workspaces', 'list', '--json'], {
+            shell: false,
             encoding: 'utf8',
             timeout: 10000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -1293,7 +1296,8 @@ function syncWorkspace() {
     if (!target)
         return;
     try {
-        execSync(`ductape workspaces use "${target}"`, {
+        execFileSync('ductape', ['workspaces', 'use', target], {
+            shell: false,
             encoding: 'utf8',
             timeout: 10000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -1306,7 +1310,14 @@ function syncWorkspace() {
     }
 }
 function runCli(command) {
-    const first = command.trim().split(/\s+/)[0];
+    let argv;
+    try {
+        argv = parseCliCommand(command);
+    }
+    catch (error) {
+        return { success: false, output: `Rejected unsafe ductape_cli command: ${error.message}` };
+    }
+    const first = argv[0];
     if (!ADMIN_SUBCOMMANDS.includes(first)) {
         return {
             success: false,
@@ -1314,13 +1325,13 @@ function runCli(command) {
         };
     }
     // Auto-inject --workspace on login if DUCTAPE_WORKSPACE is set and caller hasn't specified one
-    let finalCommand = command;
     const ws = process.env.DUCTAPE_WORKSPACE;
-    if (first === 'login' && ws && !command.includes('--workspace') && !command.includes('--skip-workspace-select')) {
-        finalCommand = `${command} --workspace "${ws}"`;
+    if (first === 'login' && ws && !argv.includes('--workspace') && !argv.includes('--skip-workspace-select')) {
+        argv.push('--workspace', ws);
     }
     try {
-        const output = execSync(`ductape ${finalCommand}`, {
+        const output = execFileSync('ductape', argv, {
+            shell: false,
             encoding: 'utf8',
             // Must exceed the proxy's operation timeout so stderr can preserve the structured timeout
             // instead of this wrapper killing the CLI first and reducing it to "(no data)".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node scripts/check-frontend-analytics-guidance.mjs && node scripts/check-events-discovery.mjs && node scripts/check-schema-fallback.mjs && node scripts/check-portable-functions.mjs",
+    "test": "npm run build && node scripts/check-cli-command-security.mjs && node scripts/check-frontend-analytics-guidance.mjs && node scripts/check-events-discovery.mjs && node scripts/check-schema-fallback.mjs && node scripts/check-portable-functions.mjs",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts"
   },