@klhapp/skillmux 1.9.1 → 1.9.3

package/src/commands/update.ts

@@ -2,6 +2,7 @@ import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { expandHome, loadConfig } from "../config";
 import {
+  assertHostAllowed,
   cloneToTemp,
   installIntoVault,
   isLocalFileUrl,
@@ -37,6 +38,7 @@ async function resolveCandidateOrigins(
   vaultPath: string,
   skillId: string | undefined,
   allowLocalSource: boolean,
+  allowedHosts: string[] | undefined,
 ): Promise<{ skillId: string; origin: SkillOrigin }[]> {
   if (skillId) {
     // skillId (the CLI's positional <skill-id>) is joined straight into vaultPath
@@ -65,7 +67,7 @@ async function resolveCandidateOrigins(
     }
     return [{ skillId, origin }];
   }
-  const outdated = await checkOutdated(vaultPath, { allowLocalSource });
+  const outdated = await checkOutdated(vaultPath, { allowLocalSource, allowedHosts });
   return outdated
     .filter((result) => result.status === "outdated")
     .map((result) => ({ skillId: result.skill_id, origin: readSkillOrigin(join(vaultPath, result.skill_id))! }));
@@ -76,6 +78,7 @@ async function buildPlan(
   candidates: { skillId: string; origin: SkillOrigin }[],
   failOn: ScanSeverity | undefined,
   force: boolean,
+  allowedHosts: string[] | undefined,
 ): Promise<UpdatePlanItem[]> {
   const plan: UpdatePlanItem[] = [];
   for (const { skillId, origin } of candidates) {
@@ -118,6 +121,7 @@ async function buildPlan(
       continue;
     }
 
+    assertHostAllowed(origin.source_url, allowedHosts);
     const cloneDir = await cloneToTemp(origin.source_url);
     const resolved = resolveSkillDir(cloneDir, skillId, origin.skill_path);
     const base = {
@@ -206,10 +210,11 @@ function parseUpdateArgs(args: string[]): {
 
 export async function runUpdate(args: string[], options: { isJson: boolean }): Promise<void> {
   const { skillId, yes, dryRun, force, failOn, allowLocalSource } = parseUpdateArgs(args);
-  const vaultPath = expandHome((await loadConfig()).vault_path);
+  const config = await loadConfig();
+  const vaultPath = expandHome(config.vault_path);
 
-  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource);
-  const plan = await buildPlan(vaultPath, candidates, failOn, force);
+  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource, config.egress?.allowed_hosts);
+  const plan = await buildPlan(vaultPath, candidates, failOn, force, config.egress?.allowed_hosts);
   try {
     const toWrite = plan.filter((item) => item.kind === "update");
 

package/src/concurrency-limiter.ts

@@ -0,0 +1,61 @@
+export class ConcurrencyLimiter {
+  private inFlight = 0;
+
+  constructor(private readonly max: number) {}
+
+  tryAcquire(): boolean {
+    if (this.inFlight >= this.max) return false;
+    this.inFlight++;
+    return true;
+  }
+
+  release(): void {
+    this.inFlight = Math.max(0, this.inFlight - 1);
+  }
+}
+
+/**
+ * Wraps a response body so `release` fires when the stream actually finishes
+ * (fully drained or cancelled by a client disconnect) instead of as soon as
+ * the Response object is constructed. For a buffered body this happens almost
+ * immediately; for an open SSE stream it defers release until the connection
+ * really closes, so a concurrency limiter reflects true connection lifetime.
+ */
+export function releaseOnStreamClose(
+  body: ReadableStream<Uint8Array> | null,
+  release: () => void,
+): ReadableStream<Uint8Array> | null {
+  if (!body) {
+    release();
+    return null;
+  }
+
+  const reader = body.getReader();
+  let released = false;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    release();
+  };
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          releaseOnce();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (error) {
+        controller.error(error);
+        releaseOnce();
+      }
+    },
+    cancel(reason) {
+      releaseOnce();
+      return reader.cancel(reason);
+    },
+  });
+}

package/src/config.ts

@@ -87,10 +87,15 @@ const configSchema = z.object({
       enabled: z.boolean(),
       token_env: z.string().min(1),
     }).strict().optional(),
+    max_body_bytes: z.number().int().positive().optional(),
+    max_concurrent_requests: z.number().int().min(0).optional(),
   }).strict().optional(),
   audit: z.object({
     retention_days: z.number().int().min(0).default(90),
   }).strict().default({ retention_days: 90 }),
+  egress: z.object({
+    allowed_hosts: z.array(z.string().min(1)).optional(),
+  }).strict().optional(),
 }).strict().refine((cfg) => {
   const hasReranker = cfg.inference.mode === "remote" && !!cfg.inference.reranker;
   if (hasReranker && cfg.output.max_top_k > cfg.recall.k_rerank) {
@@ -170,6 +175,18 @@ export function expandHome(path: string): string {
   return path.startsWith("~") ? join(homedir(), path.slice(1)) : path;
 }
 
+/**
+ * True only for hostnames the HTTP server can bind while staying unreachable
+ * from outside this machine. Deliberately narrower than adapters.ts's
+ * isLoopbackHost, which treats "0.0.0.0" as loopback for a different question
+ * (whether an admin *client* is talking to the local machine) — here "0.0.0.0"
+ * (and any other wildcard/public address) must read as non-loopback, since
+ * binding it is exactly what makes the server reachable from outside (SMX-91).
+ */
+export function isLoopbackBindHost(hostname: string): boolean {
+  return hostname === "localhost" || hostname === "::1" || hostname === "127.0.0.1" || hostname.startsWith("127.");
+}
+
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/src/db.ts

@@ -1,4 +1,5 @@
 import { Database } from "bun:sqlite";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import type { AuditCandidate, AuditRow } from "./types";
@@ -48,6 +49,14 @@ export function openAudit(stateDir: string): Database {
     resolve_audit_id INTEGER,
     rank_at_resolve INTEGER
   )`);
+  db.run(`CREATE TABLE IF NOT EXISTS admin_audit (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts TEXT NOT NULL,
+    changes TEXT NOT NULL,
+    resulting_revision TEXT NOT NULL,
+    row_hash TEXT NOT NULL,
+    prev_row_hash TEXT
+  )`);
   adoptAuditFromIndex(db, stateDir);
   return db;
 }
@@ -382,32 +391,131 @@ export function insertFetch(db: Database, row: FetchInsert): void {
 export interface PruneResult {
   audit_deleted: number;
   fetch_deleted: number;
+  admin_audit_deleted: number;
 }
 
 /**
- * Deletes resolve and fetch rows with ts before `cutoffIso`, each by its own
- * timestamp; no FK ties them, so a fetch outliving its resolve row simply
- * reads back uncorrelated (AC7's existing null path). Reclaims the freed
+ * Deletes resolve, fetch, and admin_audit rows with ts before `cutoffIso`,
+ * each by its own timestamp; no FK ties them, so a fetch outliving its
+ * resolve row simply reads back uncorrelated (AC7's existing null path).
+ * admin_audit shares this cutoff rather than a separate retention config
+ * (AC10) — its hash chain is unaffected since pruning only ever removes the
+ * oldest rows, never rows in the middle of the chain. Reclaims the freed
  * pages with an incremental vacuum, which only touches audit.sqlite3 (AC16).
  */
 export function pruneAuditBefore(db: Database, cutoffIso: string): PruneResult {
   const auditResult = db.run("DELETE FROM audit WHERE ts < ?", [cutoffIso]);
   const fetchResult = db.run("DELETE FROM fetch WHERE ts < ?", [cutoffIso]);
+  const adminAuditResult = db.run("DELETE FROM admin_audit WHERE ts < ?", [cutoffIso]);
   db.run("PRAGMA incremental_vacuum");
 
-  return { audit_deleted: auditResult.changes, fetch_deleted: fetchResult.changes };
+  return {
+    audit_deleted: auditResult.changes,
+    fetch_deleted: fetchResult.changes,
+    admin_audit_deleted: adminAuditResult.changes,
+  };
 }
 
 /** AC12: retentionDays <= 0 disables pruning entirely. */
 export function pruneAudit(db: Database, retentionDays: number, now: Date = new Date()): PruneResult {
-  if (retentionDays <= 0) return { audit_deleted: 0, fetch_deleted: 0 };
+  if (retentionDays <= 0) return { audit_deleted: 0, fetch_deleted: 0, admin_audit_deleted: 0 };
   const cutoff = new Date(now.getTime() - retentionDays * 86_400_000).toISOString();
   return pruneAuditBefore(db, cutoff);
 }
 
+export interface AdminAuditChange {
+  key: string;
+  old_value: unknown;
+  new_value: unknown;
+}
+
+export interface AdminAuditInsert {
+  ts: string;
+  changes: AdminAuditChange[];
+  resulting_revision: string;
+}
+
+export interface AdminAuditRow {
+  id: number;
+  ts: string;
+  changes: AdminAuditChange[];
+  resulting_revision: string;
+  row_hash: string;
+  prev_row_hash: string | null;
+}
+
+function computeAdminAuditRowHash(
+  prevRowHash: string | null,
+  fields: { ts: string; changes: AdminAuditChange[]; resulting_revision: string },
+): string {
+  const payload = JSON.stringify({ prev_row_hash: prevRowHash, ...fields });
+  return createHash("sha256").update(payload).digest("hex");
+}
+
+/**
+ * Appends one tamper-evident admin_audit row, chaining its hash to the
+ * previous row's hash (or null for the first row) so any out-of-band
+ * edit/delete breaks the chain — see verifyAdminAuditChain.
+ */
+export function insertAdminAuditRow(db: Database, row: AdminAuditInsert): AdminAuditRow {
+  const prevRow = db
+    .query("SELECT row_hash FROM admin_audit ORDER BY id DESC LIMIT 1")
+    .get() as { row_hash: string } | null;
+  const prevRowHash = prevRow?.row_hash ?? null;
+  const rowHash = computeAdminAuditRowHash(prevRowHash, row);
+
+  db.run(
+    `INSERT INTO admin_audit (ts, changes, resulting_revision, row_hash, prev_row_hash)
+     VALUES (?, ?, ?, ?, ?)`,
+    [row.ts, JSON.stringify(row.changes), row.resulting_revision, rowHash, prevRowHash],
+  );
+
+  const inserted = db.query("SELECT last_insert_rowid() AS id").get() as { id: number };
+  return {
+    id: inserted.id,
+    ts: row.ts,
+    changes: row.changes,
+    resulting_revision: row.resulting_revision,
+    row_hash: rowHash,
+    prev_row_hash: prevRowHash,
+  };
+}
+
+export interface AdminAuditChainResult {
+  valid: boolean;
+  broken_at_id: number | null;
+}
+
+/** Walks admin_audit in insertion order and reports whether the hash chain is unbroken. */
+export function verifyAdminAuditChain(db: Database): AdminAuditChainResult {
+  const rows = db
+    .query("SELECT id, ts, changes, resulting_revision, row_hash, prev_row_hash FROM admin_audit ORDER BY id ASC")
+    .all() as { id: number; ts: string; changes: string; resulting_revision: string; row_hash: string; prev_row_hash: string | null }[];
+
+  let expectedPrevHash: string | null = null;
+  for (const row of rows) {
+    if (row.prev_row_hash !== expectedPrevHash) {
+      return { valid: false, broken_at_id: row.id };
+    }
+    const recomputed = computeAdminAuditRowHash(expectedPrevHash, {
+      ts: row.ts,
+      changes: JSON.parse(row.changes),
+      resulting_revision: row.resulting_revision,
+    });
+    if (recomputed !== row.row_hash) {
+      return { valid: false, broken_at_id: row.id };
+    }
+    expectedPrevHash = row.row_hash;
+  }
+  return { valid: true, broken_at_id: null };
+}
+
 /** Dry-run counterpart of pruneAuditBefore: counts without deleting (AC15). */
 export function countPrunable(db: Database, cutoffIso: string): PruneResult {
   const auditRow = db.query("SELECT count(*) AS n FROM audit WHERE ts < ?").get(cutoffIso) as { n: number };
   const fetchRow = db.query("SELECT count(*) AS n FROM fetch WHERE ts < ?").get(cutoffIso) as { n: number };
-  return { audit_deleted: auditRow.n, fetch_deleted: fetchRow.n };
+  const adminAuditRow = db
+    .query("SELECT count(*) AS n FROM admin_audit WHERE ts < ?")
+    .get(cutoffIso) as { n: number };
+  return { audit_deleted: auditRow.n, fetch_deleted: fetchRow.n, admin_audit_deleted: adminAuditRow.n };
 }

package/src/doctor.ts

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync } from "node:fs";
 import { createClients, RemoteInferenceError } from "./clients";
-import { embeddingDimension, expandHome } from "./config";
+import { embeddingDimension, expandHome, isLoopbackBindHost } from "./config";
 import { describeDeployment, type DeploymentIdentity } from "./deployment";
 import { parseManifest, resolveManifestPath, validateManifest } from "./manifest";
 import { readSkillmuxMarker } from "./sync";
@@ -51,6 +51,30 @@ export async function diagnose(
   }
   checks.push({ name: "vault", ok: existsSync(expandHome(config.vault_path)), detail: expandHome(config.vault_path) });
 
+  // SMX-91: `serve --transport http` itself refuses to start over this combination
+  // (assertSafeBindPosture in server.ts) unless SKILLMUX_ALLOW_INSECURE_BIND is set —
+  // surface it here too so it's visible without having to start the HTTP server first.
+  // An operator who has already set that env var has made an informed choice, so
+  // doctor treats it the same way the server does (ok, not a standing failure) —
+  // it doesn't re-litigate a decision the server itself already accepted.
+  if (config.server) {
+    const hostname = config.server.hostname ?? "127.0.0.1";
+    const insecureBindAcknowledged = environment.SKILLMUX_ALLOW_INSECURE_BIND === "true";
+    const bindIsSafe = isLoopbackBindHost(hostname) || config.server.auth_enabled || insecureBindAcknowledged;
+    checks.push({
+      name: "server_bind_posture",
+      ok: bindIsSafe,
+      detail: !bindIsSafe
+        ? `${hostname} is reachable beyond this machine with auth_enabled=false — ` +
+          "MCP tools and /stats would be open to anyone who can reach this port; " +
+          "set server.auth_enabled=true, bind a loopback hostname, or set SKILLMUX_ALLOW_INSECURE_BIND=true"
+        : insecureBindAcknowledged && !isLoopbackBindHost(hostname) && !config.server.auth_enabled
+          ? `${hostname}, auth_enabled=false, acknowledged via SKILLMUX_ALLOW_INSECURE_BIND`
+          : `${hostname}, auth_enabled=${config.server.auth_enabled}`,
+      failure_kind: bindIsSafe ? undefined : "configuration",
+    });
+  }
+
   for (const localPath of config.local_vault_paths) {
     const expanded = expandHome(localPath);
     checks.push({ name: `local_vault:${localPath}`, ok: existsSync(expanded), detail: expanded });

package/src/install.ts

@@ -45,6 +45,21 @@ export function resolveRepoSource(repo: string): RepoSource {
   return rest.length > 0 ? { url, skillPath: rest.join("/") } : { url };
 }
 
+function extractHost(url: string): string {
+  const scpMatch = url.match(/^[^/\s]+@([^/\s]+):/);
+  if (scpMatch) return scpMatch[1]!;
+  return new URL(url).hostname;
+}
+
+export function assertHostAllowed(url: string, allowedHosts: string[] | undefined): void {
+  if (!allowedHosts || allowedHosts.length === 0) return;
+  if (isLocalFileUrl(url)) return;
+  const host = extractHost(url);
+  if (!allowedHosts.map((h) => h.toLowerCase()).includes(host.toLowerCase())) {
+    throw new Error(`refusing to fetch from host "${host}" — not in [egress] allowed_hosts`);
+  }
+}
+
 export function deriveRepoName(url: string): string {
   const cleaned = url.replace(/\.git$/, "");
   const segment = cleaned.split(/[/:]/).filter(Boolean).pop();

package/src/rate-limiter.ts

@@ -3,6 +3,14 @@ interface Bucket {
   lastRefillMs: number;
 }
 
+// SMX-93: bounds memory even when an attacker (behind a trust_proxy-honored
+// reverse proxy) mints unbounded distinct X-Forwarded-For values, or a
+// long-running deployment simply accumulates many distinct legitimate
+// clients over time. Past this many entries, the least-recently-used
+// bucket is evicted to make room — active clients are never evicted ahead
+// of idle ones.
+const DEFAULT_MAX_BUCKETS = 10_000;
+
 export interface RateLimitCheckInput {
   nowMs: number;
   auth_enabled: boolean;
@@ -22,12 +30,19 @@ export class RateLimiter {
   private enabled: boolean;
   private requests_per_minute: number;
   private trust_proxy: boolean;
+  private max_buckets: number;
   private buckets = new Map<string, Bucket>();
 
-  constructor(config: { enabled: boolean; requests_per_minute: number; trust_proxy?: boolean }) {
+  constructor(config: {
+    enabled: boolean;
+    requests_per_minute: number;
+    trust_proxy?: boolean;
+    max_buckets?: number;
+  }) {
     this.enabled = config.enabled;
     this.requests_per_minute = config.requests_per_minute;
     this.trust_proxy = config.trust_proxy ?? false;
+    this.max_buckets = config.max_buckets ?? DEFAULT_MAX_BUCKETS;
   }
 
   check(input: RateLimitCheckInput): RateLimitCheckResult {
@@ -59,7 +74,19 @@ export class RateLimiter {
 
     // 2. Retrieve or initialize bucket
     let bucket = this.buckets.get(id);
-    if (!bucket) {
+    if (bucket) {
+      // Map iteration order is insertion order, so re-inserting on touch
+      // marks this entry as most-recently-used and moves it out of the
+      // eviction path below.
+      this.buckets.delete(id);
+      this.buckets.set(id, bucket);
+    } else {
+      if (this.buckets.size >= this.max_buckets) {
+        const oldestId = this.buckets.keys().next().value;
+        if (oldestId !== undefined) {
+          this.buckets.delete(oldestId);
+        }
+      }
       bucket = {
         tokens: this.requests_per_minute,
         lastRefillMs: input.nowMs,

package/src/redact.ts

@@ -0,0 +1,52 @@
+const PLACEHOLDER = "[REDACTED]";
+
+// Strips userinfo (user:pass@) from URLs unconditionally, since a
+// credential-bearing git URL (private-repo PAT auth) is typed by the user
+// directly and never resolved from a config `*_env` key, so it can't be
+// caught by the config-driven scrub below.
+const URL_USERINFO = /:\/\/[^/\s@]*@/g;
+
+function redactUrlCredentials(text: string): string {
+  return text.replace(URL_USERINFO, `://${PLACEHOLDER}@`);
+}
+
+/**
+ * Walks the config tree for every string-valued key ending in `_env`
+ * (api_key_env, token_env, auth_token_env, and any future one) and resolves
+ * each to its current environment value.
+ */
+function collectSecretValues(value: unknown): string[] {
+  const secrets: string[] = [];
+  const visit = (node: unknown): void => {
+    if (Array.isArray(node)) {
+      for (const item of node) visit(item);
+      return;
+    }
+    if (node === null || typeof node !== "object") return;
+    for (const [key, val] of Object.entries(node as Record<string, unknown>)) {
+      if (key.endsWith("_env") && typeof val === "string") {
+        const resolved = process.env[val];
+        if (resolved) secrets.push(resolved);
+      } else {
+        visit(val);
+      }
+    }
+  };
+  visit(value);
+  return secrets;
+}
+
+/**
+ * Builds a redactor bound to the currently effective config: a pure
+ * `(text) => text` closure that scrubs any resolved `*_env` secret value.
+ */
+export function buildRedactor(config: unknown): (text: string) => string {
+  const secrets = collectSecretValues(config);
+  return (text: string): string => {
+    let result = redactUrlCredentials(text);
+    for (const secret of secrets) {
+      result = result.split(secret).join(PLACEHOLDER);
+    }
+    return result;
+  };
+}