@levr-one/cli 0.7.0 → 0.7.1

package/dist/{addHandler-7QMKiy7o.js → addHandler-Brr4ndcR.js}

@@ -1044,6 +1044,11 @@ const KNOWN_MCP_URLS = {
 * deployments) derives `<api-url>/v1/mcp`.
 */
 function resolveMcpUrl(flagUrl) {
+	const resolved = resolveRaw(flagUrl);
+	assertUsableMcpUrl(resolved.url, resolved.source);
+	return resolved;
+}
+function resolveRaw(flagUrl) {
 	if (flagUrl) return {
 		url: stripSlash(flagUrl),
 		source: "flag"
@@ -1059,6 +1064,41 @@ function resolveMcpUrl(flagUrl) {
 		source: `derived:${apiUrl}`
 	};
 }
+/** Name the input the user has to change, not our internal source tag. */
+function sourceLabel(source) {
+	if (source === "flag") return "--url";
+	if (source === "env:LEVR_MCP_URL") return "LEVR_MCP_URL";
+	return `the API URL (${source.slice(8)})`;
+}
+/**
+* Reject a URL that must not reach a client config or a spawned CLI (ENG-4159).
+*
+* Three things this stops:
+*
+* 1. **No scheme.** `claude mcp add --transport http --scope user levr <value>`
+*    is spawned with fixed argv since ENG-4156, so a value like `--foo` is read
+*    by that CLI as a FLAG rather than as its URL operand — argument injection.
+*    Requiring a parseable absolute URL removes the shape entirely.
+* 2. **A non-http(s) scheme.** `file:` / `javascript:` is never a valid MCP
+*    endpoint, but would be written verbatim into every client's config.
+* 3. **Embedded credentials.** `https://user:pass@host` would be written into
+*    a config file — and since ENG-4151 a config file can be `--scope project`,
+*    which the user is told to COMMIT. That turns a bad URL into a secret in
+*    git history. MCP authenticates via OAuth in the browser; credentials in
+*    the URL are never needed.
+*/
+function assertUsableMcpUrl(url, source) {
+	const from = sourceLabel(source);
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} is not a URL. Expected an absolute http(s) URL, e.g. https://ai.levr.one/api/v1/mcp`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} uses "${parsed.protocol}" — only http and https are supported.`);
+	if (!parsed.hostname) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} has no host.`);
+	if (parsed.username || parsed.password) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} embeds credentials. They would be written into client config files — including project-scoped ones you are told to commit. Levr authenticates in the browser; remove the user:password@ prefix.`);
+}
 function knownMcpUrl(apiUrl) {
 	try {
 		return KNOWN_MCP_URLS[new URL(apiUrl).host];
@@ -1268,7 +1308,15 @@ const defaultDeps = {
 	install: defaultInstall
 };
 async function mcpAddHandler(flags) {
-	const { url, source } = resolveMcpUrl(flags.url);
+	let url;
+	let source;
+	try {
+		({url, source} = resolveMcpUrl(flags.url));
+	} catch (err) {
+		this.logger.error(err instanceof Error ? err.message : "Could not resolve the MCP URL.");
+		this.process.exitCode = 1;
+		return;
+	}
 	const clients = (flags.client ?? []).flatMap((c) => c.split(",").map((s) => s.trim()).filter(Boolean));
 	const options = {
 		all: flags.all,

package/dist/cli.js

@@ -172,7 +172,7 @@ Examples:
 		aliases: { y: "yes" }
 	},
 	loader: async () => {
-		const { mcpAddHandler } = await import("./addHandler-7QMKiy7o.js");
+		const { mcpAddHandler } = await import("./addHandler-Brr4ndcR.js");
 		return mcpAddHandler;
 	}
 });
@@ -551,7 +551,7 @@ Examples:
 
 //#endregion
 //#region package.json
-var version = "0.7.0";
+var version = "0.7.1";
 
 //#endregion
 //#region src/app.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",