@ductape/mcp 0.2.9 → 0.2.11

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.9
+
+- Security: execute `ductape_cli` with an argument array and no shell, reject shell operators/substitutions, and validate quoted command input before checking the administrative subcommand allowlist.
+
 ## Unreleased
 
 - Broadened Feature guidance from durable/event-driven workflows to synchronous or asynchronous named product capabilities.

package/dist/cli-command.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Parse the user-facing command string into an argv array without invoking a shell.
+ * Supports ordinary single/double quoting and backslash escaping for paths/values.
+ */
+export declare function parseCliCommand(command: string): string[];
+//# sourceMappingURL=cli-command.d.ts.map

package/dist/cli-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-command.d.ts","sourceRoot":"","sources":["../src/cli-command.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAmDzD"}

package/dist/cli-command.js

@@ -0,0 +1,66 @@
+/** Characters with shell control/expansion meaning are never valid in ductape_cli input. */
+const SHELL_META = /[;&|`$<>()\r\n\0]/;
+/**
+ * Parse the user-facing command string into an argv array without invoking a shell.
+ * Supports ordinary single/double quoting and backslash escaping for paths/values.
+ */
+export function parseCliCommand(command) {
+    if (typeof command !== 'string' || command.trim() === '') {
+        throw new Error('A non-empty Ductape CLI command is required.');
+    }
+    if (SHELL_META.test(command)) {
+        throw new Error('Shell operators, substitutions, redirects, and control characters are not allowed.');
+    }
+    const argv = [];
+    let token = '';
+    let quote = null;
+    let tokenStarted = false;
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index];
+        if (quote) {
+            if (char === quote) {
+                quote = null;
+            }
+            else if (char === '\\' && quote === '"') {
+                index += 1;
+                if (index >= command.length)
+                    throw new Error('Trailing escape in Ductape CLI command.');
+                token += command[index];
+            }
+            else {
+                token += char;
+            }
+            tokenStarted = true;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            tokenStarted = true;
+        }
+        else if (char === '\\') {
+            index += 1;
+            if (index >= command.length)
+                throw new Error('Trailing escape in Ductape CLI command.');
+            token += command[index];
+            tokenStarted = true;
+        }
+        else if (/\s/.test(char)) {
+            if (tokenStarted) {
+                argv.push(token);
+                token = '';
+                tokenStarted = false;
+            }
+        }
+        else {
+            token += char;
+            tokenStarted = true;
+        }
+    }
+    if (quote)
+        throw new Error('Unterminated quote in Ductape CLI command.');
+    if (tokenStarted)
+        argv.push(token);
+    if (argv.length === 0)
+        throw new Error('A non-empty Ductape CLI command is required.');
+    return argv;
+}

package/dist/index.js

@@ -10,7 +10,8 @@
  * the env var when provided.
  */
 import { createRequire } from 'module';
-import { execFileSync, execSync } from 'child_process';
+import { execFileSync } from 'child_process';
+import { parseCliCommand } from './cli-command.js';
 import { homedir } from 'os';
 import { delimiter, join } from 'path';
 import { z } from 'zod';
@@ -234,6 +235,36 @@ There are THREE categories of operations. Use the right tool for each:
          - For cloud-linked envs, set config.cloud to the connection tag for that env and
            omit raw credentials; the cloud connection must exist for that env too.
 
+       ⚠ PERSIST AGAINST AN ALREADY-REGISTERED COMPONENT TAG CAN SILENTLY NO-OP:
+       import-persist-all / provision-persist-all call the component's create method first and only
+       fall back to update if create throws. Depending on platform version, create against an existing
+       tag can resolve successfully without changing anything instead of throwing — so the response can
+       report success (and, for provision, a real cloud resource gets created) while the Ductape
+       component record is left completely unchanged, still pointing at whatever it pointed at before.
+       Never trust a success response alone when persisting against an existing tag:
+         1. ALWAYS re-fetch the component immediately after — ductape_cli("resources <type> get -t <tag> --json")
+         2. Diff the fields you meant to change (e.g. envs[].config.cloud) against what you intended.
+         3. If unchanged, treat the persist as failed even though it reported success, and say so —
+            do not retry the same call in a loop; report it and ask before continuing.
+
+       ⚠ DUCTAPE NEVER DEPROVISIONS REAL CLOUD RESOURCES — THIS IS INTENTIONAL, NOT A GAP:
+       There is no verb, flag, or code path anywhere in Ductape (CLI, SDK, or backend) that deletes an
+       actual cloud resource (a GCS/S3 bucket, a Pub/Sub/SNS topic, a database instance, etc.). This is a
+       deliberate product decision — auto-deprovisioning real infrastructure risks destroying real data,
+       so that responsibility is left entirely to the human operator via the cloud provider's own console
+       or CLI (gcloud, aws, az, …). Concretely:
+         - ductape_cli("resources <type> delete -t <tag>") only clears Ductape's own catalog record
+           (soft delete). It never touches the underlying cloud resource — that resource still exists and
+           still costs money/still needs manual cleanup after this call succeeds.
+         - provision-persist(-all) and import-persist(-all) create/link real cloud resources but there
+           is no symmetric "deprovision" or "cloud resources delete" operation — attempting
+           ductape_cli("cloud resources delete ...") returns a clear error explaining this by design.
+         - If a provisioning attempt fails partway through, or a component is deleted, any real cloud
+           resources it created are orphaned and will keep existing (and accruing cost) until the operator
+           deletes them manually. Surface this to the user explicitly rather than treating it as something
+           this tooling can clean up — do not propose scripting cloud-provider deletes on the user's behalf
+           unless they explicitly ask for that as a separate, one-off action outside of Ductape.
+
   2. RUNTIME OPERATIONS  (run, dispatch, execute, start, send, produce, query, insert, update, delete…)
        The "input" field shape is product- and operation-specific — it is NOT derivable from Joi validators.
        It is defined by how the product's action/feature/session/quota/etc. was configured in Ductape.
@@ -1250,7 +1281,8 @@ const ADMIN_SUBCOMMANDS = [
 ];
 function checkCli() {
     try {
-        const out = execSync('ductape --version', {
+        const out = execFileSync('ductape', ['--version'], {
+            shell: false,
             encoding: 'utf8',
             timeout: 15000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -1272,7 +1304,8 @@ function checkLoginState() {
         // `ductape whoami` only reports whether a local credentials file exists. It does not validate
         // the stored token, so an expired token would be cached as authenticated and fail later with 401.
         // Use a harmless authenticated read to validate the credential against the API.
-        execSync('ductape workspaces list --json', {
+        execFileSync('ductape', ['workspaces', 'list', '--json'], {
+            shell: false,
             encoding: 'utf8',
             timeout: 10000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -1293,7 +1326,8 @@ function syncWorkspace() {
     if (!target)
         return;
     try {
-        execSync(`ductape workspaces use "${target}"`, {
+        execFileSync('ductape', ['workspaces', 'use', target], {
+            shell: false,
             encoding: 'utf8',
             timeout: 10000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -1306,7 +1340,14 @@ function syncWorkspace() {
     }
 }
 function runCli(command) {
-    const first = command.trim().split(/\s+/)[0];
+    let argv;
+    try {
+        argv = parseCliCommand(command);
+    }
+    catch (error) {
+        return { success: false, output: `Rejected unsafe ductape_cli command: ${error.message}` };
+    }
+    const first = argv[0];
     if (!ADMIN_SUBCOMMANDS.includes(first)) {
         return {
             success: false,
@@ -1314,13 +1355,13 @@ function runCli(command) {
         };
     }
     // Auto-inject --workspace on login if DUCTAPE_WORKSPACE is set and caller hasn't specified one
-    let finalCommand = command;
     const ws = process.env.DUCTAPE_WORKSPACE;
-    if (first === 'login' && ws && !command.includes('--workspace') && !command.includes('--skip-workspace-select')) {
-        finalCommand = `${command} --workspace "${ws}"`;
+    if (first === 'login' && ws && !argv.includes('--workspace') && !argv.includes('--skip-workspace-select')) {
+        argv.push('--workspace', ws);
     }
     try {
-        const output = execSync(`ductape ${finalCommand}`, {
+        const output = execFileSync('ductape', argv, {
+            shell: false,
             encoding: 'utf8',
             // Must exceed the proxy's operation timeout so stderr can preserve the structured timeout
             // instead of this wrapper killing the CLI first and reducing it to "(no data)".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node scripts/check-frontend-analytics-guidance.mjs && node scripts/check-events-discovery.mjs && node scripts/check-schema-fallback.mjs && node scripts/check-portable-functions.mjs",
+    "test": "npm run build && node scripts/check-cli-command-security.mjs && node scripts/check-frontend-analytics-guidance.mjs && node scripts/check-events-discovery.mjs && node scripts/check-schema-fallback.mjs && node scripts/check-portable-functions.mjs",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts"
   },