@kaitranntt/ccs 7.78.0-dev.9 → 7.78.1

package/lib/mcp/ccs-browser-server.cjs

@@ -151,8 +151,6 @@ const DEFAULT_DRAG_STEPS = 5;
 const MAX_POINTER_ACTIONS = 25;
 const SESSION_START_SETTLE_WINDOW_MS = 250;
 const MAX_ARTIFACT_FILE_BYTES = 5 * 1024 * 1024;
-const MAX_LOCAL_TRANSFER_FILE_BYTES = 10 * 1024 * 1024;
-const MAX_LOCAL_TRANSFER_FILES = 10;
 const SAFE_ARTIFACT_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const SESSION_CANCELED_ERROR_CODE = 'SESSION_CANCELED';
 
@@ -179,37 +177,6 @@ const recentDownloads = [];
 const interceptSessionsByPageId = new Map();
 let browserDownloadSession = null;
 let sessionDownloadDir = '';
-const SENSITIVE_LOCAL_PATH_SEGMENTS = new Set([
-  '.ssh',
-  '.gnupg',
-  '.aws',
-  '.azure',
-  '.kube',
-  '.docker',
-  '.npmrc',
-  '.netrc',
-  '.pypirc',
-  '.config',
-  '.claude',
-  '.ccs',
-]);
-const SENSITIVE_LOCAL_FILE_NAMES = new Set([
-  '.env',
-  'id_rsa',
-  'id_dsa',
-  'id_ecdsa',
-  'id_ed25519',
-  'known_hosts',
-  'authorized_keys',
-  'credentials',
-  'credentials.json',
-  'config.json',
-  'settings.json',
-  'history',
-  '.bash_history',
-  '.zsh_history',
-  '.fish_history',
-]);
 const MAX_RECENT_REQUESTS = 100;
 const MAX_RECENT_DOWNLOADS = 100;
 const FETCH_FAIL_ERROR_REASON = 'Failed';
@@ -1471,105 +1438,10 @@ function getSessionDownloadPath() {
   return sessionDownloadDir;
 }
 
-function splitConfiguredPathRoots(value) {
-  return String(value || '')
-    .split(path.delimiter)
-    .map((entry) => entry.trim())
-    .filter(Boolean)
-    .map((entry) => path.resolve(entry));
-}
-
-function getDownloadSafeRoots() {
-  return [
-    getSessionDownloadPath(),
-    ...splitConfiguredPathRoots(process.env.CCS_BROWSER_DOWNLOAD_ROOTS),
-  ];
-}
-
-function getUploadSafeRoots() {
-  return [
-    getSessionDownloadPath(),
-    ...splitConfiguredPathRoots(process.env.CCS_BROWSER_UPLOAD_ROOTS),
-  ];
-}
-
-function getNearestExistingAncestor(candidatePath) {
-  let currentPath = candidatePath;
-  while (!fs.existsSync(currentPath)) {
-    const parentPath = path.dirname(currentPath);
-    if (parentPath === currentPath) {
-      return currentPath;
-    }
-    currentPath = parentPath;
-  }
-  return currentPath;
-}
-
-function resolveExistingRoot(rootPath) {
-  fs.mkdirSync(rootPath, { recursive: true });
-  return fs.realpathSync(rootPath);
-}
-
-function resolvePathWithRealAncestor(candidatePath) {
-  const resolvedPath = path.resolve(candidatePath);
-  const ancestorPath = getNearestExistingAncestor(resolvedPath);
-  const realAncestorPath = fs.realpathSync(ancestorPath);
-  const relativeSuffix = path.relative(ancestorPath, resolvedPath);
-  return relativeSuffix ? path.resolve(realAncestorPath, relativeSuffix) : realAncestorPath;
-}
-
-function isPathInsideRoot(candidatePath, rootPath) {
-  const relativePath = path.relative(rootPath, candidatePath);
-  return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));
-}
-
-function findContainingRoot(candidatePath, rootPaths) {
-  return rootPaths.find((rootPath) => isPathInsideRoot(candidatePath, rootPath)) || '';
-}
-
-function getLocalPathSegments(candidatePath, rootPath) {
-  const rootSegments = path.resolve(rootPath).split(path.sep).filter(Boolean);
-  const relativePath = path.relative(rootPath, candidatePath);
-  const relativeSegments = relativePath.split(path.sep).filter(Boolean);
-  return [...rootSegments, ...relativeSegments];
-}
-
-function assertNoSensitiveLocalPathSegments(candidatePath, rootPath, label) {
-  const segments = getLocalPathSegments(candidatePath, rootPath);
-  for (const segment of segments) {
-    const normalizedSegment = segment.toLowerCase();
-    if (normalizedSegment.startsWith('.') || SENSITIVE_LOCAL_PATH_SEGMENTS.has(normalizedSegment)) {
-      throw new Error(`${label} cannot include hidden or sensitive path segment: ${segment}`);
-    }
-  }
-
-  const fileName = path.basename(candidatePath).toLowerCase();
-  if (SENSITIVE_LOCAL_FILE_NAMES.has(fileName)) {
-    throw new Error(
-      `${label} cannot reference sensitive file name: ${path.basename(candidatePath)}`
-    );
-  }
-}
-
 function ensureWritableDirectory(downloadPath) {
-  const resolvedPath = path.resolve(downloadPath);
-  const candidatePath = resolvePathWithRealAncestor(resolvedPath);
-  const safeRoots = getDownloadSafeRoots().map(resolveExistingRoot);
-  const containingRoot = findContainingRoot(candidatePath, safeRoots);
-  if (!containingRoot) {
-    throw new Error(
-      'downloadPath must be inside the browser session download directory or a CCS_BROWSER_DOWNLOAD_ROOTS entry'
-    );
-  }
-  assertNoSensitiveLocalPathSegments(candidatePath, containingRoot, 'downloadPath');
-
-  fs.mkdirSync(resolvedPath, { recursive: true });
-  const realDownloadPath = fs.realpathSync(resolvedPath);
-  if (!isPathInsideRoot(realDownloadPath, containingRoot)) {
-    throw new Error('downloadPath cannot traverse outside the allowed download root');
-  }
-  fs.accessSync(realDownloadPath, fs.constants.W_OK);
-  return realDownloadPath;
+  fs.mkdirSync(downloadPath, { recursive: true });
+  fs.accessSync(downloadPath, fs.constants.W_OK);
+  return downloadPath;
 }
 
 function pushRecentDownload(entry) {
@@ -2546,35 +2418,16 @@ function buildFileInputHandleExpression(selector, nth, frameSelector, pierceShad
 }
 
 function validateLocalFiles(files) {
-  if (files.length > MAX_LOCAL_TRANSFER_FILES) {
-    throw new Error(`files exceeds maximum of ${MAX_LOCAL_TRANSFER_FILES}`);
-  }
-
-  const safeRoots = getUploadSafeRoots().map(resolveExistingRoot);
   return files.map((filePath) => {
     const resolvedPath = path.resolve(filePath);
     if (!fs.existsSync(resolvedPath)) {
       throw new Error(`file does not exist: ${resolvedPath}`);
     }
-    const realFilePath = fs.realpathSync(resolvedPath);
-    const containingRoot = findContainingRoot(realFilePath, safeRoots);
-    if (!containingRoot) {
-      throw new Error(
-        'file must be inside the browser session download directory or a CCS_BROWSER_UPLOAD_ROOTS entry'
-      );
-    }
-    assertNoSensitiveLocalPathSegments(realFilePath, containingRoot, 'file');
-
-    const stat = fs.statSync(realFilePath);
+    const stat = fs.statSync(resolvedPath);
     if (!stat.isFile()) {
-      throw new Error(`file is not a regular file: ${realFilePath}`);
-    }
-    if (stat.size > MAX_LOCAL_TRANSFER_FILE_BYTES) {
-      throw new Error(
-        `file exceeds maximum size of ${MAX_LOCAL_TRANSFER_FILE_BYTES} bytes: ${realFilePath}`
-      );
+      throw new Error(`file is not a regular file: ${resolvedPath}`);
     }
-    return realFilePath;
+    return resolvedPath;
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaitranntt/ccs",
-  "version": "7.78.0-dev.9",
+  "version": "7.78.1",
   "description": "Claude Code Switch - Instant profile switching between Claude, GLM, Kimi, and more",
   "keywords": [
     "cli",

package/dist/cliproxy/auth/oauth-start-failure-guidance.d.ts

@@ -1,22 +0,0 @@
-import type { CLIProxyProvider } from '../types';
-import { type ProxyTarget } from '../proxy/proxy-target-resolver';
-export interface OAuthStartFailureGuidance {
-    error: 'cliproxy_oauth_start_failed';
-    provider: CLIProxyProvider;
-    message: string;
-    details: string;
-    hints: string[];
-    endpoint: string | null;
-    retryCommand: string;
-    portForwardCommand?: string;
-}
-interface GuidanceOptions {
-    target: ProxyTarget;
-    startPath?: string | null;
-    cause?: unknown;
-    addAccount?: boolean;
-}
-export declare function buildOAuthStartFailureGuidance(provider: CLIProxyProvider, options: GuidanceOptions): OAuthStartFailureGuidance;
-export declare function formatOAuthStartFailureForCli(guidance: OAuthStartFailureGuidance): string[];
-export {};
-//# sourceMappingURL=oauth-start-failure-guidance.d.ts.map

package/dist/cliproxy/auth/oauth-start-failure-guidance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-start-failure-guidance.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/oauth-start-failure-guidance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAEjF,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,6BAA6B,CAAC;IACrC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,UAAU,eAAe;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAyBD,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,eAAe,GACvB,yBAAyB,CAmD3B;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,EAAE,CAQ3F"}

package/dist/cliproxy/auth/oauth-start-failure-guidance.js

@@ -1,82 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.formatOAuthStartFailureForCli = exports.buildOAuthStartFailureGuidance = void 0;
-const provider_capabilities_1 = require("../provider-capabilities");
-const proxy_target_resolver_1 = require("../proxy/proxy-target-resolver");
-function getCauseMessage(cause) {
-    if (cause instanceof Error && cause.message.trim()) {
-        return cause.message.trim();
-    }
-    if (typeof cause === 'string' && cause.trim()) {
-        return cause.trim();
-    }
-    return null;
-}
-function buildAuthCommand(provider, flag, addAccount) {
-    const parts = ['ccs', provider, '--auth'];
-    if (addAccount) {
-        parts.push('--add');
-    }
-    parts.push(flag);
-    return parts.join(' ');
-}
-function buildOAuthStartFailureGuidance(provider, options) {
-    const { target, startPath, cause, addAccount } = options;
-    const displayName = (0, provider_capabilities_1.getProviderDisplayName)(provider);
-    const endpoint = startPath ? (0, proxy_target_resolver_1.buildProxyUrl)(target, startPath) : null;
-    const causeMessage = getCauseMessage(cause);
-    const retryCommand = buildAuthCommand(provider, '--paste-callback', addAccount);
-    const portForwardRetryCommand = buildAuthCommand(provider, '--port-forward', addAccount);
-    const callbackPort = (0, provider_capabilities_1.getOAuthCallbackPort)(provider);
-    const portForwardCommand = callbackPort
-        ? `ssh -L ${callbackPort}:localhost:${callbackPort} <USER>@<HOST>`
-        : undefined;
-    const targetDescription = target.isRemote
-        ? `remote CLIProxy management API at ${target.protocol}://${target.host}:${target.port}`
-        : `local CLIProxy management API at ${target.protocol}://${target.host}:${target.port}`;
-    const message = `${displayName} OAuth could not start through the ${targetDescription}.`;
-    const details = [
-        endpoint ? `Endpoint: ${endpoint}` : null,
-        causeMessage ? `Cause: ${causeMessage}` : null,
-    ]
-        .filter(Boolean)
-        .join(' ');
-    const hints = target.isRemote
-        ? [
-            'Verify the remote CLIProxy server is running and reachable from this machine.',
-            'Check cliproxy_server.remote.management_key or auth_token in CCS config.',
-            `After fixing the remote proxy, retry: ${retryCommand}`,
-        ]
-        : [
-            'Start local CLIProxy first: ccs cliproxy start',
-            `Then retry paste-callback mode: ${retryCommand}`,
-            ...(portForwardCommand
-                ? [
-                    `For SSH/VPS auth, open a tunnel from your local machine: ${portForwardCommand}`,
-                    `Then run inside that SSH session: ${portForwardRetryCommand}`,
-                ]
-                : []),
-        ];
-    return {
-        error: 'cliproxy_oauth_start_failed',
-        provider,
-        message,
-        details,
-        hints,
-        endpoint,
-        retryCommand,
-        portForwardCommand,
-    };
-}
-exports.buildOAuthStartFailureGuidance = buildOAuthStartFailureGuidance;
-function formatOAuthStartFailureForCli(guidance) {
-    const lines = [guidance.message];
-    if (guidance.details) {
-        lines.push(guidance.details);
-    }
-    lines.push('Next steps:');
-    lines.push(...guidance.hints.map((hint) => `  - ${hint}`));
-    return lines;
-}
-exports.formatOAuthStartFailureForCli = formatOAuthStartFailureForCli;
-//# sourceMappingURL=oauth-start-failure-guidance.js.map

package/dist/cliproxy/auth/oauth-start-failure-guidance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-start-failure-guidance.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/oauth-start-failure-guidance.ts"],"names":[],"mappings":";;;AACA,oEAAwF;AACxF,0EAAiF;AAoBjF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA0B,EAC1B,IAA2C,EAC3C,UAAoB;IAEpB,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAgB,8BAA8B,CAC5C,QAA0B,EAC1B,OAAwB;IAExB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,WAAW,GAAG,IAAA,8CAAsB,EAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAA,qCAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;IAChF,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,IAAA,4CAAoB,EAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,YAAY;QACrC,CAAC,CAAC,UAAU,YAAY,cAAc,YAAY,gBAAgB;QAClE,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ;QACvC,CAAC,CAAC,qCAAqC,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;QACxF,CAAC,CAAC,oCAAoC,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAE1F,MAAM,OAAO,GAAG,GAAG,WAAW,sCAAsC,iBAAiB,GAAG,CAAC;IACzF,MAAM,OAAO,GAAG;QACd,QAAQ,CAAC,CAAC,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;QACzC,YAAY,CAAC,CAAC,CAAC,UAAU,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/C;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ;QAC3B,CAAC,CAAC;YACE,+EAA+E;YAC/E,0EAA0E;YAC1E,yCAAyC,YAAY,EAAE;SACxD;QACH,CAAC,CAAC;YACE,gDAAgD;YAChD,mCAAmC,YAAY,EAAE;YACjD,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC;oBACE,4DAA4D,kBAAkB,EAAE;oBAChF,qCAAqC,uBAAuB,EAAE;iBAC/D;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IAEN,OAAO;QACL,KAAK,EAAE,6BAA6B;QACpC,QAAQ;QACR,OAAO;QACP,OAAO;QACP,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAtDD,wEAsDC;AAED,SAAgB,6BAA6B,CAAC,QAAmC;IAC/E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AARD,sEAQC"}