@mgsoftwarebv/mg-dashboard-mcp 2.1.0 → 2.1.1

package/dist/index.js

@@ -386,12 +386,29 @@ async function attemptVercelSync(appName, environment, knownStageId) {
     return `Vercel sync error: ${msg}`;
   }
 }
+var SSH_PROXY_SERVER_ID = "03659d55-e194-400d-b82a-bf6457371ded";
+var _proxyConnCache = null;
+async function getProxyConnection() {
+  if (_proxyConnCache) return _proxyConnCache;
+  const { data, error } = await supabase.from("ssh_server").select("hostname, port, username, password_encrypted, ssh_key_encrypted, ssh_key_passphrase_encrypted").eq("id", SSH_PROXY_SERVER_ID).single();
+  if (error || !data) throw new Error("SSH Proxy server not found in database");
+  if (!encryptionKey) throw new Error("ENCRYPTION_KEY required to decrypt server credentials");
+  _proxyConnCache = {
+    hostname: data.hostname,
+    port: data.port || 22,
+    username: data.username,
+    password: data.password_encrypted ? decrypt(data.password_encrypted) : void 0,
+    privateKey: data.ssh_key_encrypted ? decrypt(data.ssh_key_encrypted) : void 0,
+    passphrase: data.ssh_key_passphrase_encrypted ? decrypt(data.ssh_key_passphrase_encrypted) : void 0
+  };
+  return _proxyConnCache;
+}
 async function getServerConnection(serverId) {
   assertServerAccess(serverId);
-  const { data, error } = await supabase.from("ssh_server").select("hostname, port, username, password_encrypted, ssh_key_encrypted, ssh_key_passphrase_encrypted").eq("id", serverId).single();
+  const { data, error } = await supabase.from("ssh_server").select("hostname, port, username, password_encrypted, ssh_key_encrypted, ssh_key_passphrase_encrypted, allowed_ssh_ips").eq("id", serverId).single();
   if (error || !data) throw new Error(`Server not found: ${serverId}`);
   if (!encryptionKey) throw new Error("ENCRYPTION_KEY required to decrypt server credentials");
-  return {
+  const conn = {
     hostname: data.hostname,
     port: data.port || 22,
     username: data.username,
@@ -399,8 +416,12 @@ async function getServerConnection(serverId) {
     privateKey: data.ssh_key_encrypted ? decrypt(data.ssh_key_encrypted) : void 0,
     passphrase: data.ssh_key_passphrase_encrypted ? decrypt(data.ssh_key_passphrase_encrypted) : void 0
   };
+  const needsProxy = data.allowed_ssh_ips !== null && serverId !== SSH_PROXY_SERVER_ID;
+  const proxy = needsProxy ? await getProxyConnection() : void 0;
+  return { conn, proxy };
 }
-async function sshExec(opts, command) {
+async function sshExec(opts, command, proxy) {
+  if (proxy) return sshExecViaProxy(proxy, opts, command);
   return new Promise((resolve) => {
     const ssh = new Client();
     let stdout = "";
@@ -459,6 +480,98 @@ async function sshExec(opts, command) {
     });
   });
 }
+function sshExecViaProxy(proxyOpts, targetOpts, command) {
+  return new Promise((resolve) => {
+    const proxyClient = new Client();
+    let done = false;
+    const timeout = targetOpts.timeout || 6e4;
+    const timer = setTimeout(() => {
+      if (!done) {
+        done = true;
+        proxyClient.end();
+        resolve({ stdout: "", stderr: "SSH proxy command timeout", exitCode: -1 });
+      }
+    }, timeout);
+    const cleanup = () => {
+      clearTimeout(timer);
+      proxyClient.end();
+    };
+    proxyClient.on("ready", () => {
+      proxyClient.forwardOut("127.0.0.1", 0, targetOpts.hostname, targetOpts.port, (err, tunnel) => {
+        if (err) {
+          if (!done) {
+            done = true;
+            cleanup();
+            resolve({ stdout: "", stderr: err.message, exitCode: -1 });
+          }
+          return;
+        }
+        const targetClient = new Client();
+        let stdout = "";
+        let stderr = "";
+        targetClient.on("ready", () => {
+          targetClient.exec(command, (execErr, stream) => {
+            if (execErr) {
+              if (!done) {
+                done = true;
+                targetClient.end();
+                cleanup();
+                resolve({ stdout, stderr, exitCode: -1 });
+              }
+              return;
+            }
+            stream.on("data", (d) => {
+              stdout += d.toString();
+            });
+            stream.stderr.on("data", (d) => {
+              stderr += d.toString();
+            });
+            stream.on("close", (code) => {
+              if (!done) {
+                done = true;
+                targetClient.end();
+                cleanup();
+                resolve({ stdout, stderr, exitCode: code ?? 0 });
+              }
+            });
+          });
+        });
+        targetClient.on("error", (targetErr) => {
+          if (!done) {
+            done = true;
+            targetClient.end();
+            cleanup();
+            resolve({ stdout, stderr: targetErr.message, exitCode: -1 });
+          }
+        });
+        targetClient.connect({
+          sock: tunnel,
+          username: targetOpts.username,
+          password: targetOpts.password,
+          privateKey: targetOpts.privateKey,
+          passphrase: targetOpts.passphrase,
+          readyTimeout: timeout
+        });
+      });
+    });
+    proxyClient.on("error", (err) => {
+      if (!done) {
+        done = true;
+        cleanup();
+        resolve({ stdout: "", stderr: err.message, exitCode: -1 });
+      }
+    });
+    proxyClient.connect({
+      host: proxyOpts.hostname,
+      port: proxyOpts.port,
+      username: proxyOpts.username,
+      password: proxyOpts.password,
+      privateKey: proxyOpts.privateKey,
+      passphrase: proxyOpts.passphrase,
+      readyTimeout: proxyOpts.timeout || 3e4
+    });
+  });
+}
 function sanitizePath(path) {
   let normalized = path.replace(/\\/g, "/").replace(/\0/g, "");
   const parts = normalized.split("/");
@@ -743,7 +856,7 @@ function assertAllowedLogPath(filePath) {
     throw new Error(`Path not allowed. Must be under: ${ALLOWED_LOG_PREFIXES.join(", ")}`);
   }
 }
-async function discoverSiteDatabases(conn) {
+async function discoverSiteDatabases(conn, proxy) {
   const script = `
 check_dir() {
   local base="$1" root="$2"
@@ -780,7 +893,7 @@ for dir in /var/www/*/; do
   done
 done
 `.trim();
-  const result = await sshExec(conn, script);
+  const result = await sshExec(conn, script, proxy);
   const sites = [];
   for (const line of result.stdout.split("\n")) {
     if (!line.trim()) continue;
@@ -864,9 +977,9 @@ DB_PORT=\${DB_PORT:-3306}
 mysql --user="$DB_USER" --password="$DB_PASS" --host="$DB_HOST" --port="$DB_PORT" -t -e '${safeQuery}' "$DB_NAME" 2>&1 | grep -v "\\[Warning\\].*password"
 `.trim();
 }
-async function execSiteMysql(conn, sitePath, query) {
+async function execSiteMysql(conn, sitePath, query, proxy) {
   const cmd = buildSiteMysqlCommand(sitePath, query);
-  const result = await sshExec(conn, cmd);
+  const result = await sshExec(conn, cmd, proxy);
   const output = (result.stdout || "").trim();
   if (output.startsWith("ERROR: No database config found")) {
     throw new Error(output);
@@ -1338,9 +1451,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         return { content: [{ type: "text", text: lines.length ? lines.join("\n") : "No servers found" }] };
       }
       case "server-status": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         const cmd = 'echo "=== UPTIME ===" && uptime && echo "=== DISK ===" && df -h --total && echo "=== MEMORY ===" && free -h && echo "=== LOAD ===" && cat /proc/loadavg';
-        const result = await sshExec(conn, cmd);
+        const result = await sshExec(conn, cmd, proxy);
         const output = result.exitCode === 0 ? result.stdout : `Exit ${result.exitCode}
 ${result.stdout}
 ${result.stderr}`;
@@ -1350,9 +1463,9 @@ ${result.stderr}`;
       case "ssh-execute": {
         const command = String(a.command);
         assertSafeCommand(command);
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         if (a.timeout) conn.timeout = Number(a.timeout);
-        const result = await sshExec(conn, command);
+        const result = await sshExec(conn, command, proxy);
         const output = [`Exit code: ${result.exitCode}`];
         if (result.stdout) output.push(`--- stdout ---
 ${result.stdout}`);
@@ -1361,45 +1474,45 @@ ${result.stderr}`);
         return { content: [{ type: "text", text: output.join("\n") }] };
       }
       case "server-reboot": {
-        const conn = await getServerConnection(String(a.serverId));
-        const result = await sshExec(conn, "sudo reboot");
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
+        const result = await sshExec(conn, "sudo reboot", proxy);
         return { content: [{ type: "text", text: result.exitCode === 0 ? "Reboot command sent. Server will be unavailable shortly." : `Reboot failed: ${result.stderr}` }] };
       }
       case "server-restart-service": {
         const service = String(a.serviceName).replace(/[^a-zA-Z0-9._@-]/g, "");
-        const conn = await getServerConnection(String(a.serverId));
-        const result = await sshExec(conn, `sudo systemctl restart ${service}`);
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
+        const result = await sshExec(conn, `sudo systemctl restart ${service}`, proxy);
         if (result.exitCode === 0) {
-          const status = await sshExec(conn, `sudo systemctl is-active ${service}`);
+          const status = await sshExec(conn, `sudo systemctl is-active ${service}`, proxy);
           return { content: [{ type: "text", text: `Service "${service}" restarted. Status: ${status.stdout.trim()}` }] };
         }
         return { content: [{ type: "text", text: `Failed to restart "${service}": ${result.stderr}` }] };
       }
-      // ----- SFTP -----
+      // ----- SFTP (no proxy support yet — direct connection only) -----
       case "sftp-list": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn } = await getServerConnection(String(a.serverId));
         const listing = await sftpReaddir(conn, String(a.path || "/"));
         return { content: [{ type: "text", text: listing }] };
       }
       case "sftp-read": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn } = await getServerConnection(String(a.serverId));
         const content = await sftpRead(conn, String(a.path));
         return { content: [{ type: "text", text: content }] };
       }
       case "sftp-write": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn } = await getServerConnection(String(a.serverId));
         const result = await sftpWrite(conn, String(a.path), String(a.content));
         return { content: [{ type: "text", text: result }] };
       }
       case "sftp-delete": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn } = await getServerConnection(String(a.serverId));
         const result = await sftpDelete(conn, String(a.path));
         return { content: [{ type: "text", text: result }] };
       }
       // ----- Docker -----
       case "docker-list": {
-        const conn = await getServerConnection(String(a.serverId));
-        const result = await sshExec(conn, 'docker ps -a --format "table {{.Names}}	{{.Image}}	{{.Status}}	{{.Ports}}"');
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
+        const result = await sshExec(conn, 'docker ps -a --format "table {{.Names}}	{{.Image}}	{{.Status}}	{{.Ports}}"', proxy);
         return { content: [{ type: "text", text: result.exitCode === 0 ? result.stdout : `Error: ${result.stderr}` }] };
       }
       case "docker-action": {
@@ -1408,22 +1521,22 @@ ${result.stderr}`);
         if (!["start", "stop", "restart", "remove"].includes(action)) {
           throw new Error(`Invalid action: ${action}. Use start, stop, restart, or remove.`);
         }
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         const dockerCmd = action === "remove" ? `docker rm -f ${container}` : `docker ${action} ${container}`;
-        const result = await sshExec(conn, dockerCmd);
+        const result = await sshExec(conn, dockerCmd, proxy);
         return { content: [{ type: "text", text: result.exitCode === 0 ? `Container "${container}" ${action}ed successfully` : `Error: ${result.stderr}` }] };
       }
       case "docker-logs": {
         const container = String(a.containerName).replace(/[^a-zA-Z0-9._-]/g, "");
         const lines = Number(a.lines) || 100;
-        const conn = await getServerConnection(String(a.serverId));
-        const result = await sshExec(conn, `docker logs --tail ${lines} ${container} 2>&1`);
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
+        const result = await sshExec(conn, `docker logs --tail ${lines} ${container} 2>&1`, proxy);
         return { content: [{ type: "text", text: result.exitCode === 0 ? result.stdout : `Error: ${result.stderr}` }] };
       }
       // ----- Database -----
       case "db-discover": {
-        const conn = await getServerConnection(String(a.serverId));
-        const sites = await discoverSiteDatabases(conn);
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
+        const sites = await discoverSiteDatabases(conn, proxy);
         if (!sites.length) {
           return { content: [{ type: "text", text: "No web applications with database configs found in /var/www/" }] };
         }
@@ -1433,26 +1546,27 @@ ${result.stderr}`);
         return { content: [{ type: "text", text: lines.join("\n") }] };
       }
       case "db-tables": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         const sql = "SELECT TABLE_NAME, ENGINE, TABLE_ROWS, ROUND(DATA_LENGTH/1024/1024, 2) AS `Size (MB)`, TABLE_COLLATION FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE() ORDER BY TABLE_NAME";
-        const output = await execSiteMysql(conn, String(a.sitePath), sql);
+        const output = await execSiteMysql(conn, String(a.sitePath), sql, proxy);
         return { content: [{ type: "text", text: output || "No tables found" }] };
       }
       case "db-describe": {
         const table = String(a.table).replace(/[^a-zA-Z0-9_]/g, "");
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         const output = await execSiteMysql(
           conn,
           String(a.sitePath),
-          `DESCRIBE \`${table}\`; SHOW INDEX FROM \`${table}\``
+          `DESCRIBE \`${table}\`; SHOW INDEX FROM \`${table}\``,
+          proxy
         );
         return { content: [{ type: "text", text: output }] };
       }
       case "db-query": {
         const query = String(a.query).trim();
         assertSafeSql(query);
-        const conn = await getServerConnection(String(a.serverId));
-        const output = await execSiteMysql(conn, String(a.sitePath), query);
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
+        const output = await execSiteMysql(conn, String(a.sitePath), query, proxy);
         return { content: [{ type: "text", text: output || "Query executed successfully (no output)" }] };
       }
       // ----- Env Config -----
@@ -1550,7 +1664,7 @@ ${result.stderr}`);
       }
       // ----- Cache Purge -----
       case "cache-purge": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         conn.timeout = 12e4;
         const script = `
 R=""
@@ -1631,13 +1745,13 @@ else
 fi
 echo -e "$R"
 `.trim();
-        const result = await sshExec(conn, script);
+        const result = await sshExec(conn, script, proxy);
         const output = (result.stdout || "").trim();
         return { content: [{ type: "text", text: output || "Cache purge completed (no output)" }] };
       }
       // ----- Log Reading -----
       case "log-list": {
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         const script = `
 {
   [ -d /usr/local/lsws/logs ] && find /usr/local/lsws/logs -maxdepth 2 -name "*.log" -type f 2>/dev/null
@@ -1663,7 +1777,7 @@ echo -e "$R"
   echo "$f  $HR  $MOD"
 done
 `.trim();
-        const result = await sshExec(conn, script);
+        const result = await sshExec(conn, script, proxy);
         return { content: [{ type: "text", text: result.stdout || "No log files found" }] };
       }
       case "log-read": {
@@ -1671,9 +1785,9 @@ done
         assertAllowedLogPath(logPath);
         const lineCount = Math.min(Math.max(Number(a.lines) || 100, 1), 500);
         const filter = a.filter ? String(a.filter).replace(/'/g, "'\\''") : "";
-        const conn = await getServerConnection(String(a.serverId));
+        const { conn, proxy } = await getServerConnection(String(a.serverId));
         const cmd = filter ? `grep '${filter}' '${logPath}' 2>/dev/null | tail -n ${lineCount}` : `tail -n ${lineCount} '${logPath}' 2>/dev/null`;
-        const result = await sshExec(conn, cmd);
+        const result = await sshExec(conn, cmd, proxy);
         if (result.exitCode !== 0 && !result.stdout) {
           throw new Error(result.stderr || `Failed to read log: ${logPath}`);
         }
@@ -1681,21 +1795,21 @@ done
       }
       // ----- Cron Jobs -----
       case "cron-list": {
-        const conn = await getServerConnection(a.serverId);
+        const { conn, proxy } = await getServerConnection(a.serverId);
         const user = a.user ? String(a.user) : null;
         const parts = [];
         if (user) {
-          const result = await sshExec(conn, `crontab -l -u ${user} 2>/dev/null || echo '(no crontab for ${user})'`);
+          const result = await sshExec(conn, `crontab -l -u ${user} 2>/dev/null || echo '(no crontab for ${user})'`, proxy);
           parts.push(`## Crontab for ${user}
 ${result.stdout}`);
         } else {
-          const rootCron = await sshExec(conn, `crontab -l 2>/dev/null || echo '(no crontab for root)'`);
+          const rootCron = await sshExec(conn, `crontab -l 2>/dev/null || echo '(no crontab for root)'`, proxy);
           parts.push(`## Root crontab
 ${rootCron.stdout}`);
-          const wwwCron = await sshExec(conn, `crontab -l -u www-data 2>/dev/null || echo '(no crontab for www-data)'`);
+          const wwwCron = await sshExec(conn, `crontab -l -u www-data 2>/dev/null || echo '(no crontab for www-data)'`, proxy);
           parts.push(`## www-data crontab
 ${wwwCron.stdout}`);
-          const cronD = await sshExec(conn, `for f in /etc/cron.d/*; do [ -f "$f" ] && echo "--- $f ---" && cat "$f" && echo; done 2>/dev/null || echo '(no files in /etc/cron.d/)'`);
+          const cronD = await sshExec(conn, `for f in /etc/cron.d/*; do [ -f "$f" ] && echo "--- $f ---" && cat "$f" && echo; done 2>/dev/null || echo '(no files in /etc/cron.d/)'`, proxy);
           parts.push(`## /etc/cron.d/
 ${cronD.stdout}`);
           const summary = await sshExec(conn, [
@@ -1704,13 +1818,13 @@ ${cronD.stdout}`);
             `echo "cron.daily:   $(ls /etc/cron.daily/ 2>/dev/null | wc -l) scripts"`,
             `echo "cron.weekly:  $(ls /etc/cron.weekly/ 2>/dev/null | wc -l) scripts"`,
             `echo "cron.monthly: $(ls /etc/cron.monthly/ 2>/dev/null | wc -l) scripts"`
-          ].join(" && "));
+          ].join(" && "), proxy);
           parts.push(summary.stdout);
         }
         return { content: [{ type: "text", text: parts.join("\n\n") }] };
       }
       case "cron-add": {
-        const conn = await getServerConnection(a.serverId);
+        const { conn, proxy } = await getServerConnection(a.serverId);
         const user = a.user ? String(a.user) : "root";
         const schedule = String(a.schedule).trim();
         const command = String(a.command).trim();
@@ -1720,7 +1834,7 @@ ${cronD.stdout}`);
         }
         const entry = commentText ? `# ${commentText}
 ${schedule} ${command}` : `${schedule} ${command}`;
-        const result = await sshExec(conn, `(crontab -l -u ${user} 2>/dev/null; echo '${entry.replace(/'/g, "'\\''")}') | crontab -u ${user} -`);
+        const result = await sshExec(conn, `(crontab -l -u ${user} 2>/dev/null; echo '${entry.replace(/'/g, "'\\''")}') | crontab -u ${user} -`, proxy);
         if (result.exitCode !== 0) {
           throw new Error(result.stderr || "Failed to add cron job");
         }
@@ -1728,13 +1842,13 @@ ${schedule} ${command}` : `${schedule} ${command}`;
 ${schedule} ${command}` }] };
       }
       case "cron-remove": {
-        const conn = await getServerConnection(a.serverId);
+        const { conn, proxy } = await getServerConnection(a.serverId);
         const user = a.user ? String(a.user) : "root";
         const match = String(a.commandMatch).trim();
         if (!match) {
           throw new Error("commandMatch is required");
         }
-        const current = await sshExec(conn, `crontab -l -u ${user} 2>/dev/null`);
+        const current = await sshExec(conn, `crontab -l -u ${user} 2>/dev/null`, proxy);
         const lines = current.stdout.split("\n");
         const before = lines.length;
         const filtered = lines.filter((line) => {
@@ -1746,21 +1860,21 @@ ${schedule} ${command}` }] };
           return { content: [{ type: "text", text: `No cron entries found matching "${match}"` }] };
         }
         const escapedCrontab = filtered.join("\n").replace(/'/g, "'\\''");
-        const result = await sshExec(conn, `echo '${escapedCrontab}' | crontab -u ${user} -`);
+        const result = await sshExec(conn, `echo '${escapedCrontab}' | crontab -u ${user} -`, proxy);
         if (result.exitCode !== 0) {
           throw new Error(result.stderr || "Failed to update crontab");
         }
         return { content: [{ type: "text", text: `Removed ${removed} cron entry/entries matching "${match}" from ${user} crontab` }] };
       }
       case "cron-toggle": {
-        const conn = await getServerConnection(a.serverId);
+        const { conn, proxy } = await getServerConnection(a.serverId);
         const user = a.user ? String(a.user) : "root";
         const match = String(a.commandMatch).trim();
         const enable = Boolean(a.enable);
         if (!match) {
           throw new Error("commandMatch is required");
         }
-        const current = await sshExec(conn, `crontab -l -u ${user} 2>/dev/null`);
+        const current = await sshExec(conn, `crontab -l -u ${user} 2>/dev/null`, proxy);
         const lines = current.stdout.split("\n");
         let toggled = 0;
         const updated = lines.map((line) => {
@@ -1779,7 +1893,7 @@ ${schedule} ${command}` }] };
           return { content: [{ type: "text", text: `No ${state} cron entries found matching "${match}"` }] };
         }
         const escapedCrontab = updated.join("\n").replace(/'/g, "'\\''");
-        const result = await sshExec(conn, `echo '${escapedCrontab}' | crontab -u ${user} -`);
+        const result = await sshExec(conn, `echo '${escapedCrontab}' | crontab -u ${user} -`, proxy);
         if (result.exitCode !== 0) {
           throw new Error(result.stderr || "Failed to update crontab");
         }