@elisym/mcp 0.1.6 → 0.1.7

package/README.md

@@ -20,6 +20,9 @@ npx @elisym/mcp install --agent <agent-name>
 # List detected MCP clients
 npx @elisym/mcp install --list
 
+# Refresh the version pin in installed clients (preserves agent + env)
+npx @elisym/mcp update
+
 # Remove from MCP clients
 npx @elisym/mcp uninstall
 

package/dist/index.js

@@ -319,6 +319,35 @@ function payment() {
 }
 
 // src/install.ts
+function elisymPackageArgs() {
+  return ["-y", `@elisym/mcp@~${PACKAGE_VERSION}`];
+}
+function validateClientName(name) {
+  if (name === void 0) {
+    return;
+  }
+  if (!CLIENTS.some((c) => c.name === name)) {
+    throw new Error(
+      `Unknown client "${name}". Known clients: ${CLIENTS.map((c) => c.name).join(", ")}`
+    );
+  }
+}
+async function safeRewriteJson(path, expectedRaw, newConfig) {
+  let recheck;
+  try {
+    recheck = await readFile(path, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `${path} disappeared between read and write: ${err.message}. Re-run after the file is restored.`
+    );
+  }
+  if (recheck !== expectedRaw) {
+    throw new Error(
+      `${path} was modified by another process during update. Close the MCP client and re-run.`
+    );
+  }
+  await writeJsonAtomic(path, newConfig);
+}
 var CLIENTS = [
   {
     name: "claude-desktop",
@@ -361,7 +390,7 @@ var CLIENTS = [
 function buildServerEntry(agentName, env) {
   const entry = {
     command: "npx",
-    args: ["-y", `@elisym/mcp@~${PACKAGE_VERSION}`]
+    args: elisymPackageArgs()
   };
   const mergedEnv = { ...env };
   if (agentName) {
@@ -373,6 +402,7 @@ function buildServerEntry(agentName, env) {
   return entry;
 }
 async function runInstall(options) {
+  validateClientName(options.client);
   if (options.agent) {
     validateAgentName(options.agent);
   }
@@ -402,7 +432,12 @@ async function runInstall(options) {
     console.log("No MCP clients found to install into.");
   }
 }
-async function runUninstall(options) {
+async function runUpdate(options) {
+  validateClientName(options.client);
+  if (options.agent) {
+    validateAgentName(options.agent);
+  }
+  let updated = 0;
   for (const client of CLIENTS) {
     if (options.client && client.name !== options.client) {
       continue;
@@ -411,15 +446,105 @@ async function runUninstall(options) {
     if (!path) {
       continue;
     }
+    let raw;
     try {
-      const raw = await readFile(path, "utf-8");
-      const config = JSON.parse(raw);
-      if (config.mcpServers?.elisym) {
-        delete config.mcpServers.elisym;
-        await writeJsonAtomic(path, config);
-        console.log(`Removed from ${client.name}: ${path}`);
+      raw = await readFile(path, "utf-8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        console.log(`Skipped ${client.name}: ${err.message}`);
+      }
+      continue;
+    }
+    let config;
+    try {
+      config = JSON.parse(raw);
+    } catch {
+      console.log(`Warning: ${path} is not valid JSON. Skipping update for ${client.name}.`);
+      continue;
+    }
+    const existing = config.mcpServers?.elisym;
+    if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+      continue;
+    }
+    const rawEnv = existing.env;
+    const newEnv = rawEnv && typeof rawEnv === "object" && !Array.isArray(rawEnv) ? { ...rawEnv } : {};
+    const existingAgentRaw = typeof newEnv.ELISYM_AGENT === "string" ? newEnv.ELISYM_AGENT : void 0;
+    if (existingAgentRaw !== void 0 && options.agent === void 0) {
+      try {
+        validateAgentName(existingAgentRaw);
+      } catch (err) {
+        console.log(
+          `Skipped ${client.name}: existing ELISYM_AGENT in ${path} is invalid (${err.message}). Re-run with --agent <name> to overwrite.`
+        );
+        continue;
+      }
+    }
+    if (options.agent !== void 0) {
+      newEnv.ELISYM_AGENT = options.agent;
+    }
+    const entry = existing;
+    const newArgs = elisymPackageArgs();
+    if (Array.isArray(entry.args)) {
+      const idx = entry.args.findIndex(
+        (a) => typeof a === "string" && a.startsWith("@elisym/mcp@")
+      );
+      if (idx >= 0) {
+        entry.args[idx] = newArgs[1];
+      } else {
+        entry.args = newArgs;
       }
+    } else {
+      entry.args = newArgs;
+    }
+    if (Object.keys(newEnv).length > 0) {
+      entry.env = newEnv;
+    } else {
+      delete entry.env;
+    }
+    try {
+      await safeRewriteJson(path, raw, config);
+    } catch (err) {
+      console.log(`Skipped ${client.name}: ${err.message}`);
+      continue;
+    }
+    console.log(`Updated ${client.name}: ${path} -> @elisym/mcp@~${PACKAGE_VERSION}`);
+    updated++;
+  }
+  if (updated === 0) {
+    console.log("No existing elisym MCP installs found to update.");
+  }
+}
+async function runUninstall(options) {
+  validateClientName(options.client);
+  for (const client of CLIENTS) {
+    if (options.client && client.name !== options.client) {
+      continue;
+    }
+    const path = client.configPath();
+    if (!path) {
+      continue;
+    }
+    let raw;
+    try {
+      raw = await readFile(path, "utf-8");
+    } catch {
+      continue;
+    }
+    let config;
+    try {
+      config = JSON.parse(raw);
     } catch {
+      continue;
+    }
+    if (!config.mcpServers?.elisym) {
+      continue;
+    }
+    delete config.mcpServers.elisym;
+    try {
+      await safeRewriteJson(path, raw, config);
+      console.log(`Removed from ${client.name}: ${path}`);
+    } catch (err) {
+      console.log(`Skipped ${client.name}: ${err.message}`);
     }
   }
 }
@@ -444,18 +569,21 @@ async function writeJsonAtomic(path, data) {
   await writeFileAtomic(path, JSON.stringify(data, null, 2), 384);
 }
 async function installToConfig(path, entry) {
-  let config;
   let raw;
   try {
     raw = await readFile(path, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw err;
+    }
+    await writeJsonAtomic(path, { mcpServers: { elisym: entry } });
+    return true;
+  }
+  let config;
+  try {
     config = JSON.parse(raw);
   } catch {
-    if (raw !== void 0) {
-      console.error(
-        `Warning: ${path} is not valid JSON. A backup was saved to ${path}.elisym-backup. Other MCP server entries may have been lost - restore from backup if needed.`
-      );
-    }
-    config = {};
+    throw new Error(`${path} is not valid JSON. Fix the file manually and re-run install.`);
   }
   if (!config.mcpServers) {
     config.mcpServers = {};
@@ -463,14 +591,8 @@ async function installToConfig(path, entry) {
   if (config.mcpServers.elisym) {
     return false;
   }
-  if (raw) {
-    try {
-      await writeFile(`${path}.elisym-backup`, raw, { mode: 384 });
-    } catch {
-    }
-  }
   config.mcpServers.elisym = entry;
-  await writeJsonAtomic(path, config);
+  await safeRewriteJson(path, raw, config);
   return true;
 }
 
@@ -810,8 +932,13 @@ function normalizeConfusables(text) {
   return text.normalize("NFKC").replace(CONFUSABLE_RE, (ch) => CONFUSABLE_MAP[ch] ?? ch);
 }
 var INJECTION_PATTERNS = [
-  // Role hijacking
-  { category: "role_hijack", pattern: /\b(?:you are|act as|pretend to be|roleplay as)\b/i },
+  // Role hijacking — agents legitimately describe themselves with "act as" /
+  // "you are" in their public cards, so this is noisy in structured contexts.
+  {
+    category: "role_hijack",
+    pattern: /\b(?:you are|act as|pretend to be|roleplay as)\b/i,
+    noisy: true
+  },
   // Instruction override
   {
     category: "instruction_override",
@@ -829,16 +956,35 @@ var INJECTION_PATTERNS = [
   },
   // Delimiter injection
   { category: "delimiter_injection", pattern: /<\/system>|\[\/INST\]|```system|<\|im_end\|>/i },
-  // Data exfiltration
-  { category: "data_exfil", pattern: /\b(?:send|post|leak).*?\b(?:secret|key|password)\b/i },
+  // Data exfiltration. Require a composite term ("secret key", "api key") or a strong
+  // single noun ("password", "credential", "seed phrase"). The previous version matched
+  // the bare word "key", which produces false positives on benign phrases like
+  // "send a link, get the key points" — common in legitimate agent descriptions.
+  // Cap the gap at 40 chars within the same clause (no sentence terminators) so the
+  // verb and noun must actually relate to each other. Composite-term separators are
+  // [\s_-]? so variants like `private-key`, `secret_key`, `seed-phrase` are caught.
+  // Marked `noisy` because even after tightening, NL verb+noun phrases remain a
+  // common source of FP on free-text agent descriptions.
+  {
+    category: "data_exfil",
+    pattern: /\b(?:send|post|exfiltrate|leak)\b[^.!?\n]{0,40}\b(?:secret[\s_-]?key|api[\s_-]?key|private[\s_-]?key|password|credential|auth[\s_-]?token|seed[\s_-]?phrase|mnemonic)\b/i,
+    noisy: true
+  },
   // Payment manipulation
   { category: "payment_manipulation", pattern: /\b(?:change|modify).*?\b(?:recipient|address)\b/i },
   { category: "payment_manipulation", pattern: /\bsend all funds\b/i },
-  // Jailbreak
-  { category: "jailbreak", pattern: /\b(?:DAN mode|developer mode enabled|from now on)\b/i },
-  // Urgency
-  { category: "urgency", pattern: /^(?:IMPORTANT|CRITICAL|URGENT|SYSTEM):/m }
+  // Jailbreak — "from now on" is a common phrase in changelogs/release notes that
+  // an agent could legitimately put in its description, hence noisy.
+  {
+    category: "jailbreak",
+    pattern: /\b(?:DAN mode|developer mode enabled|from now on)\b/i,
+    noisy: true
+  },
+  // Urgency — agents may put "IMPORTANT: rate limited to N req/s" in their card,
+  // so the line-anchored prefix is noisy in structured contexts.
+  { category: "urgency", pattern: /^(?:IMPORTANT|CRITICAL|URGENT|SYSTEM):/m, noisy: true }
 ];
+var STRICT_INJECTION_PATTERNS = INJECTION_PATTERNS.filter((p) => !p.noisy);
 function stripDangerousUnicode(text) {
   return text.replace(
     // eslint-disable-next-line no-control-regex
@@ -852,14 +998,18 @@ function truncateLongLines(text) {
   ).join("\n");
 }
 var INJECTION_SCAN_BUDGET = 8e3;
-function detectInjections(text) {
+function detectInjections(text, includeNoisy) {
   const normalized = normalizeConfusables(text);
+  const patterns = includeNoisy ? INJECTION_PATTERNS : STRICT_INJECTION_PATTERNS;
   if (normalized.length <= INJECTION_SCAN_BUDGET) {
-    return INJECTION_PATTERNS.some((p) => p.pattern.test(normalized));
+    return patterns.some((p) => p.pattern.test(normalized));
   }
   const head = normalized.slice(0, INJECTION_SCAN_BUDGET);
   const tail = normalized.slice(-INJECTION_SCAN_BUDGET);
-  return INJECTION_PATTERNS.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+  return patterns.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+}
+function scanForInjections(text, mode = "full") {
+  return detectInjections(text, mode === "full");
 }
 function isLikelyBase64(s) {
   if (s.length < 64) {
@@ -868,12 +1018,13 @@ function isLikelyBase64(s) {
   const base64Chars = s.replace(/[A-Za-z0-9+/=\s]/g, "");
   return base64Chars.length / s.length < 0.05;
 }
-function sanitizeUntrusted(input, kind = "text") {
+function sanitizeUntrusted(input, kind = "text", options) {
   let text = stripDangerousUnicode(input);
   text = truncateLongLines(text);
   text = text.replaceAll(BOUNDARY_BEGIN, "--- [UNTRUSTED MARKER STRIPPED] ---");
   text = text.replaceAll(BOUNDARY_END, "--- [UNTRUSTED MARKER STRIPPED] ---");
-  const injectionsDetected = kind !== "binary" && detectInjections(text);
+  const scanned = kind !== "binary" && detectInjections(text, kind === "text");
+  const injectionsDetected = scanned || options?.extraInjectionSignal === true;
   let wrapped = `${BOUNDARY_BEGIN}
 ${text}
 ${BOUNDARY_END}`;
@@ -884,14 +1035,14 @@ ${wrapped}`;
   }
   return { text: wrapped, injectionsDetected };
 }
+function sanitizeInner(input) {
+  return truncateLongLines(stripDangerousUnicode(input));
+}
 function sanitizeField(input, maxLen) {
   let text = stripDangerousUnicode(input);
   if (text.length > maxLen) {
     text = text.slice(0, maxLen) + "...";
   }
-  if (detectInjections(text)) {
-    text = `[SUSPICIOUS] ${text}`;
-  }
   return text;
 }
 
@@ -1212,13 +1363,26 @@ var customerTools = [
           console.error("[mcp:list_my_jobs] queryJobResults failed:", e);
         }
       }
+      let freetextSuspicious = false;
       const results = mine.map((job) => {
         const dec = decryptedByRequest.get(job.eventId);
         let resultText;
         if (dec) {
-          resultText = dec.decryptionFailed ? "[decryption failed - targeted result not for this agent]" : sanitizeUntrusted(dec.content).text;
+          if (dec.decryptionFailed) {
+            resultText = "[decryption failed - targeted result not for this agent]";
+          } else {
+            const cleaned = sanitizeInner(dec.content);
+            if (scanForInjections(cleaned, "full")) {
+              freetextSuspicious = true;
+            }
+            resultText = cleaned;
+          }
         } else if (job.result) {
-          resultText = sanitizeUntrusted(job.result).text;
+          const cleaned = sanitizeInner(job.result);
+          if (scanForInjections(cleaned, "full")) {
+            freetextSuspicious = true;
+          }
+          resultText = cleaned;
         }
         return {
           event_id: job.eventId,
@@ -1229,10 +1393,11 @@ var customerTools = [
           result: resultText
         };
       });
-      return textResult(
-        `Found ${results.length} of your jobs:
-${JSON.stringify(results, null, 2)}`
-      );
+      const { text: wrapped } = sanitizeUntrusted(JSON.stringify(results, null, 2), "structured", {
+        extraInjectionSignal: freetextSuspicious
+      });
+      return textResult(`Found ${results.length} of your jobs:
+${wrapped}`);
     }
   }),
   defineTool({
@@ -2378,6 +2543,9 @@ program.command("install").description("Install elisym MCP server into client co
     await runInstall({ client: options.client, agent: options.agent });
   }
 });
+program.command("update").description("Refresh the elisym MCP entry in installed client configs").option("--client <name>", "Specific client (claude-desktop, claude-code, cursor, windsurf)").option("--agent <name>", "Override the agent binding").action(async (options) => {
+  await runUpdate({ client: options.client, agent: options.agent });
+});
 program.command("uninstall").description("Remove elisym from MCP client configs").option("--client <name>", "Specific client").action(async (options) => {
   await runUninstall({ client: options.client });
 });