@mrrlin-dev/mcp 0.4.126 → 0.4.128

package/dist/bin.cjs

@@ -58153,12 +58153,81 @@ function emptyHooksDir() {
 function gitArgs(repo, args) {
   return ["-C", repo, "-c", `core.hooksPath=${emptyHooksDir()}`, ...args];
 }
+var STEP_ENV_NAMES = /* @__PURE__ */ new Set([
+  // user, shell, temp dirs, locale
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "LANG",
+  "LANGUAGE",
+  "TZ",
+  // what a Windows toolchain needs to start at all
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "PROGRAMFILES",
+  "SYSTEMROOT",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  // proxies and the operator's own CA bundle
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "ALL_PROXY",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  // Node and its version managers
+  "NODE_ENV",
+  "NODE_PATH",
+  "NVM_BIN",
+  "NVM_DIR",
+  "VOLTA_HOME",
+  "FNM_DIR",
+  "ASDF_DIR",
+  "ASDF_DATA_DIR",
+  // the toolchains a `make test` may drive
+  "JAVA_HOME",
+  "GOPATH",
+  "GOROOT",
+  "GOCACHE",
+  "GOMODCACHE",
+  "CARGO_HOME",
+  "RUSTUP_HOME",
+  "VIRTUAL_ENV",
+  "PYENV_ROOT",
+  // git+ssh dependencies and commit signing
+  "SSH_AUTH_SOCK",
+  "GNUPGHOME"
+]);
+var STEP_ENV_PREFIXES = ["LC_", "XDG_", "NPM_CONFIG_", "YARN_", "PNPM_", "COREPACK_"];
+var CREDENTIAL_NAME = /AUTH|TOKEN|PASSWORD|SECRET/;
+function buildLocalStepEnv(baseEnv = process.env) {
+  const env = {};
+  for (const [name, value] of Object.entries(baseEnv)) {
+    if (value === void 0) continue;
+    const upper = name.toUpperCase();
+    const inFamily = STEP_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+    if (STEP_ENV_NAMES.has(upper) || inFamily && !CREDENTIAL_NAME.test(upper)) env[name] = value;
+  }
+  return env;
+}
 function git(repo, args) {
   return (0, import_node_child_process15.execFileSync)("git", gitArgs(repo, args), {
     encoding: "utf8",
     timeout: 3e4,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: { ...buildLocalStepEnv(), GIT_TERMINAL_PROMPT: "0" }
   }).trim();
 }
 function gitTry(repo, args) {
@@ -58166,7 +58235,7 @@ function gitTry(repo, args) {
     encoding: "utf8",
     timeout: 3e4,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: { ...buildLocalStepEnv(), GIT_TERMINAL_PROMPT: "0" }
   });
   return {
     status: typeof result.status === "number" ? result.status : 1,
@@ -58244,7 +58313,7 @@ function createStepRunner(options = {}) {
     let killTimer = null;
     const child = (0, import_node_child_process15.spawn)(command.file, command.args, {
       cwd,
-      env: { ...process.env, CI: "1", GIT_TERMINAL_PROMPT: "0" },
+      env: { ...buildLocalStepEnv(), CI: "1", GIT_TERMINAL_PROMPT: "0" },
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32"
     });
@@ -58606,11 +58675,11 @@ function withDisabledGitHooksEnv(env, hooksDir) {
     [`GIT_CONFIG_VALUE_${count2}`]: hooksDir
   };
 }
-function git2(checkout, args, hooksDir) {
+function git2(checkout, args, hooksDir, baseEnv = process.env) {
   return (0, import_node_child_process16.execFileSync)("git", ["-C", checkout, "-c", `core.hooksPath=${hooksDir}`, ...args], {
     encoding: "utf8",
     timeout: 3e4,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: { ...baseEnv, GIT_TERMINAL_PROMPT: "0" }
   });
 }
 async function createRunWorktree(opts) {
@@ -58645,10 +58714,11 @@ async function openRunWorktree(opts) {
   const worktreePath = (0, import_node_path19.join)(opts.worktreeRoot, opts.slug, opts.runId);
   const hooksDir = prepareDisabledGitHooksDir(opts.locksDir, opts.runId);
   const branch = worktreeBranch(opts.runId);
+  const env = buildLocalStepEnv();
   await withCheckoutLock(opts.locksDir, opts.slug, async () => {
     if ((0, import_node_fs12.existsSync)(worktreePath)) {
       const real = (0, import_node_fs12.realpathSync)(worktreePath);
-      const listed = git2(opts.checkout, ["worktree", "list", "--porcelain"], hooksDir).split(/\n\s*\n/).map((block) => block.split("\n")).find((lines2) => {
+      const listed = git2(opts.checkout, ["worktree", "list", "--porcelain"], hooksDir, env).split(/\n\s*\n/).map((block) => block.split("\n")).find((lines2) => {
         const listedPath = lines2.find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
         return listedPath !== void 0 && (0, import_node_fs12.existsSync)(listedPath) && (0, import_node_fs12.realpathSync)(listedPath) === real;
       });
@@ -58661,13 +58731,13 @@ async function openRunWorktree(opts) {
       return;
     }
     try {
-      git2(opts.checkout, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], hooksDir);
+      git2(opts.checkout, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], hooksDir, env);
     } catch {
       throw new Error(`run_branch_missing: ${opts.checkout} has no branch ${branch}`);
     }
     (0, import_node_fs12.mkdirSync)(opts.worktreeRoot, { recursive: true });
-    git2(opts.checkout, ["worktree", "prune"], hooksDir);
-    git2(opts.checkout, ["worktree", "add", worktreePath, branch], hooksDir);
+    git2(opts.checkout, ["worktree", "prune"], hooksDir, env);
+    git2(opts.checkout, ["worktree", "add", worktreePath, branch], hooksDir, env);
   });
   return worktreePath;
 }
@@ -58803,13 +58873,16 @@ async function sweepOrphanWorktrees(opts) {
 }
 
 // src/local-apply.ts
+function gitEnv() {
+  return { ...buildLocalStepEnv(), GIT_TERMINAL_PROMPT: "0" };
+}
 function gitRead(cwd, args) {
   try {
     return (0, import_node_child_process17.execFileSync)("git", ["-C", cwd, ...args], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 3e4,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: gitEnv()
     }).trim();
   } catch {
     return null;
@@ -58972,7 +59045,7 @@ async function applyLocalRunForTool(deps, input) {
       return { outcome: "conflict", previousSha: null, headSha: delivered.headSha, detail: integration.files.join(", ") };
     }
     const build = await runDetectedBuild({ worktreePath, runStep: deps.runStep });
-    const headSha = (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+    const headSha = (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8", env: gitEnv() }).trim();
     if (build.failed) {
       record2({ integration, applied: false, reason: "build_failed", headSha, steps: build.steps, logs: build.logs });
       return { outcome: "build_failed", previousSha: null, headSha, detail: build.failed.command };
@@ -59018,7 +59091,8 @@ async function applyLocalRunForTool(deps, input) {
       if (!runBranchStillSigned()) return branchChanged();
       (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "-c", `core.hooksPath=${hooksDir}`, "checkout", "-q", "--detach", delivered.headSha], {
         stdio: ["ignore", "pipe", "pipe"],
-        timeout: 3e4
+        timeout: 3e4,
+        env: gitEnv()
       });
       try {
         return await reintegrate(worktreePath);
@@ -59027,9 +59101,14 @@ async function applyLocalRunForTool(deps, input) {
         if (runBranchStillSigned()) {
           (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "-c", `core.hooksPath=${hooksDir}`, "checkout", "-q", "-f", runBranch], {
             stdio: ["ignore", "pipe", "pipe"],
-            timeout: 3e4
+            timeout: 3e4,
+            env: gitEnv()
+          });
+          (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "clean", "-q", "-f", "-d"], {
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 3e4,
+            env: gitEnv()
           });
-          (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "clean", "-q", "-f", "-d"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
         }
       }
     },
@@ -63221,7 +63300,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.126";
+var PKG_VERSION = "0.4.128";
 
 // src/receipt-signing.ts
 var import_node_crypto17 = __toESM(require("node:crypto"), 1);
@@ -69861,6 +69940,28 @@ function startArtifactsGc(baseStateDir, intervalMs = 10 * 60 * 1e3, options) {
   };
 }
 
+// src/bridge-host-guard.ts
+var LOOPBACK_HOST_NAMES = ["127.0.0.1", "localhost", "[::1]"];
+function hostHeaderName(host) {
+  const lower = host.trim().toLowerCase();
+  return lower.includes(":") && !lower.startsWith("[") ? `[${lower}]` : lower;
+}
+function isAllowedBridgeHost(hostHeader, opts) {
+  const { port, configuredHost } = opts;
+  if (!hostHeader || port === void 0) return false;
+  const names = new Set(LOOPBACK_HOST_NAMES);
+  if (configuredHost?.trim()) names.add(hostHeaderName(configuredHost));
+  const actual = hostHeader.trim().toLowerCase();
+  for (const name of names) {
+    if (actual === `${name}:${port}`) return true;
+    if (port === 80 && actual === name) return true;
+  }
+  return false;
+}
+function isAllowedBridgeRequestHost(req, configuredHost) {
+  return isAllowedBridgeHost(req.headers.host, { port: req.socket.localPort, configuredHost });
+}
+
 // src/chat-compaction.ts
 var DEFAULT_COMPACTION_SEED_BUDGET_BYTES = 8e3;
 var DEFAULT_COMPACTION_TIMEOUT_MS = 3e4;
@@ -76752,6 +76853,10 @@ function applyPnaHeaders(res, requestOrigin, allowed) {
 function createBridgeRequestListener(opts) {
   const { host, port, token, allowedOrigins, stateDir, getHealth } = opts;
   return (req, res) => {
+    if (!isAllowedBridgeRequestHost(req, host)) {
+      res.writeHead(421).end();
+      return;
+    }
     const requestOrigin = typeof req.headers.origin === "string" ? req.headers.origin : void 0;
     if (req.method === "OPTIONS") {
       applyPnaHeaders(res, requestOrigin, allowedOrigins);
@@ -76841,7 +76946,16 @@ function sessionIdOf(msg) {
 }
 function attachBridgeWss(server, opts) {
   const { token, allowedOrigins, onReady, logger, onPaired, bridgeInstanceId, selfUpdate, codex } = opts;
-  const wss = new import_websocket_server.default({ server, path: "/ws" });
+  const wss = new import_websocket_server.default({
+    server,
+    path: "/ws",
+    // The DNS-rebinding Host check from createBridgeRequestListener, applied to the upgrade: a bad
+    // Host is answered 421 and the socket is never opened, so no `ready` frame goes out.
+    verifyClient: (info, done) => {
+      if (isAllowedBridgeRequestHost(info.req, opts.host)) done(true);
+      else done(false, 421);
+    }
+  });
   wss.on("connection", (socket, request) => {
     const origin = request.headers.origin;
     if (!isOriginAllowed(origin, allowedOrigins)) {
@@ -78453,14 +78567,20 @@ function createSelectedProviderRefresher(deps) {
     }
   });
 }
+var envSigningProvider;
 function buildBridgeSigningProvider() {
   const signingKeyId = process.env.MRRLIN_SIGNING_KEY_ID;
   const signingPrivateKey = process.env.MRRLIN_SIGNING_PRIVATE_KEY;
+  delete process.env.MRRLIN_SIGNING_PRIVATE_KEY;
   if (signingKeyId && signingPrivateKey) {
-    return new LocalEd25519SigningProvider({
+    envSigningProvider = new LocalEd25519SigningProvider({
       keyId: signingKeyId,
       privateKey: signingPrivateKey
     });
+    return envSigningProvider;
+  }
+  if (signingKeyId && envSigningProvider?.getKeyId() === signingKeyId) {
+    return envSigningProvider;
   }
   const isTestOrSmoke = process.env.NODE_ENV === "test" || process.env.MRRLIN_TEST === "1" || process.env.MRRLIN_SMOKE_TEST === "1";
   if (isTestOrSmoke) {
@@ -78472,6 +78592,7 @@ function buildBridgeSigningProvider() {
   return void 0;
 }
 async function startDirectorBridge() {
+  const signingProvider = buildBridgeSigningProvider();
   const config2 = parseConfig();
   const failureLog = createFailureLog();
   const suppressedPushLine = (label, error51) => {
@@ -78609,7 +78730,6 @@ async function startDirectorBridge() {
   });
   const checkoutRegistry = new CheckoutRegistry(config2.stateDir);
   const staleSeconds = readEnvInt("MRRLIN_DIRECTOR_BRIDGE_STALE_SECONDS", DEFAULT_STALE_SECONDS);
-  const signingProvider = buildBridgeSigningProvider();
   const consumerDeps = {
     client,
     signingProvider,
@@ -78793,8 +78913,7 @@ async function startDirectorBridge() {
         inFlightRunIds: Array.from(consumerState.inFlightRunIds),
         inFlightCount: consumerState.inFlightRunIds.size,
         lastClaimAt: consumerState.lastClaimAt,
-        service: health.snapshot(),
-        localArtifactToken: config2.token
+        service: health.snapshot()
       })
     })
   );
@@ -79058,6 +79177,7 @@ async function startDirectorBridge() {
   attachBridgeWss(server, {
     token: config2.token,
     allowedOrigins: config2.allowedOrigins,
+    host: config2.host,
     onReady: createBridgeMessageHandler({
       ...sharedHandlerDeps,
       threads,
@@ -79111,6 +79231,10 @@ async function startDirectorBridge() {
   }
   const workerToken = readOrCreateWorkerToken();
   const dispatchServer = import_node_http3.default.createServer((req, res) => {
+    if (!isAllowedBridgeRequestHost(req, "127.0.0.1")) {
+      res.writeHead(421).end();
+      return;
+    }
     if (req.method !== "POST" || req.url !== "/worker/dispatch") {
       res.writeHead(404).end();
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.4.126",
+  "version": "0.4.128",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"