@remcp/runtime 0.2.106 → 0.2.108

package/src/tools/terminal.mjs

@@ -221,8 +221,10 @@ export async function interactWithProcessTool(args, extra = {}) {
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
   if (session.exited) fail(`Process ${pid} already exited`);
-  const input = typeof args.input === 'string' ? args.input : fail('input must be a string');
-  const timeoutMs = clampInteger(args.timeout_ms, 1000, 0, 120000);
+   const input = typeof args.input === 'string' ? args.input : fail('input must be a string');
+   assertAllowedCommand(input);
+   const timeoutMs = clampInteger(args.timeout_ms, 1000, 0, 120000);
+
   session.cursor = session.droppedLines + session.lines.length;
   session.waitCursor = session.cursor;
   session.lastPartialRead = null;

package/src/util.mjs

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
-import { realpath } from 'node:fs/promises';
+import { lstat, realpath } from 'node:fs/promises';
 import { liveConfig, runtimeConfig } from './config.mjs';
 
 export class ToolError extends Error {}
@@ -93,6 +93,12 @@ export async function resolveSafePath(value, field = 'path') {
   const absolute = path.resolve(raw);
   if (!runtimeConfig.allowedRoots.length) return absolute;
 
+  const leaf = await lstat(absolute).catch(error => {
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null;
+    throw error;
+  });
+  if (leaf?.isSymbolicLink()) fail(`Path is a symbolic link: ${absolute}`);
+
   // Canonicalize both sides before enforcing confinement. This matters on macOS where
   // /var is a symlink to /private/var: a safe path returned by an earlier canonicalization
   // must not be rejected merely because its lexical prefix differs from the configured root.