@samanhappy/mcphub 1.0.23 → 1.0.25

package/dist/services/mcpService.js

@@ -114,6 +114,44 @@ ${proxyLine}
     console.log(`[${serverName}] Generated proxychains4 config: ${configPath}`);
     return configPath;
 };
+/**
+ * Validate that a command is safe to execute.
+ * Blocks shell builtins and common injection patterns.
+ */
+const isSafeCommand = (command) => {
+    // Block shell builtins that could be used for command injection
+    const blockedCommands = new Set([
+        'sh', 'bash', 'zsh', 'fish', 'csh', 'ksh', 'tcsh',
+        'cmd', 'powershell', 'pwsh',
+        'eval', 'exec', 'source', '.',
+    ]);
+    const basename = command.split('/').pop()?.split('\\').pop()?.toLowerCase() || '';
+    if (blockedCommands.has(basename)) {
+        return false;
+    }
+    // Block commands with shell metacharacters
+    if (/[;&|`$(){}[\]!]/.test(command)) {
+        return false;
+    }
+    return true;
+};
+/**
+ * Sanitize arguments to prevent command injection.
+ * Removes shell metacharacters and dangerous patterns.
+ */
+const sanitizeArgs = (args) => {
+    return args.map(arg => {
+        // Remove shell metacharacters that could be used for injection
+        // Allow common flags (-f, --flag, -vvv) and paths
+        if (/^[a-zA-Z0-9._/\\:@=+,-]+$/.test(arg)) {
+            return arg;
+        }
+        // For arguments with special characters, log a warning
+        // Also block redirection operators (>, <, >>) and newlines
+        console.warn(`[proxychains] Potentially unsafe argument blocked: ${arg}`);
+        return arg.replace(/[;&|`$(){}[\]!><\n\r]/g, '');
+    });
+};
 /**
  * Wrap a command with proxychains4 if proxy is configured and available.
  * Returns modified command and args if proxychains4 is used, original values otherwise.
@@ -128,6 +166,11 @@ const wrapWithProxychains = (serverName, command, args, proxyConfig) => {
         console.warn(`[${serverName}] proxychains4 proxy is not supported on Windows, ignoring proxy configuration`);
         return { command, args };
     }
+    // SECURITY: Validate command is safe
+    if (!isSafeCommand(command)) {
+        console.error(`[${serverName}] Blocked unsafe command for proxychains4 wrapping: ${command}`);
+        throw new Error(`[${serverName}] Unsafe command blocked: ${command}. Shell builtins and metacharacters are not allowed.`);
+    }
     // Find proxychains4 binary
     const proxychains4Path = findProxychains4();
     if (!proxychains4Path) {
@@ -140,11 +183,13 @@ const wrapWithProxychains = (serverName, command, args, proxyConfig) => {
         console.warn(`[${serverName}] Failed to setup proxychains4 configuration, skipping proxy`);
         return { command, args };
     }
+    // SECURITY: Sanitize arguments
+    const sanitizedArgs = sanitizeArgs(args);
     // Wrap command with proxychains4
     console.log(`[${serverName}] Using proxychains4 proxy: ${proxyConfig.type || 'socks5'}://${proxyConfig.host}:${proxyConfig.port}`);
     return {
         command: proxychains4Path,
-        args: ['-f', configPath, command, ...args],
+        args: ['-f', configPath, command, ...sanitizedArgs],
     };
 };
 export const initUpstreamServers = async () => {
@@ -195,6 +240,131 @@ export const getMcpServer = async (sessionId, group) => {
 };
 export const deleteMcpServer = (sessionId) => {
     delete servers[sessionId];
+    // Clean up any per-session isolated upstream clients for this session
+    cleanupIsolatedSession(sessionId);
+};
+/**
+ * Close an isolated upstream client and its transport, killing the whole stdio
+ * process tree (to avoid orphaned wrappers like `npx`) when applicable.
+ */
+const closeIsolatedClient = (serverName, client, transport) => {
+    try {
+        client.close();
+    }
+    catch (e) {
+        console.warn(`[${serverName}] Error closing isolated client:`, e);
+    }
+    const candidateTransport = transport;
+    const stdioPid = typeof candidateTransport.pid === 'number' ? candidateTransport.pid : null;
+    try {
+        transport.close();
+    }
+    catch (e) {
+        console.warn(`[${serverName}] Error closing isolated transport:`, e);
+    }
+    // For stdio transports, kill the whole process tree to avoid orphans
+    if (stdioPid) {
+        killStdioProcessTree(serverName, stdioPid);
+    }
+};
+/**
+ * Clean up per-session isolated upstream clients for a given session.
+ * Closes all clients and transports, then removes the session entry.
+ */
+const cleanupIsolatedSession = (sessionId) => {
+    const sessionClients = sessionIsolatedClients.get(sessionId);
+    if (sessionClients) {
+        for (const [serverName, { client, transport }] of sessionClients) {
+            closeIsolatedClient(serverName, client, transport);
+        }
+        sessionIsolatedClients.delete(sessionId);
+        // Clean up any leftover creation locks for this session
+        for (const key of isolatedClientCreationLocks.keys()) {
+            if (key.startsWith(`${sessionId}:`)) {
+                isolatedClientCreationLocks.delete(key);
+            }
+        }
+        console.log(`Cleaned up isolated clients for session: ${sessionId}`);
+    }
+};
+/** Helper to write an isolated session upstream client into the tracking map. */
+const setSessionIsolatedClient = (sessionId, serverName, client, transport) => {
+    let sessionClients = sessionIsolatedClients.get(sessionId);
+    if (!sessionClients) {
+        sessionClients = new Map();
+        sessionIsolatedClients.set(sessionId, sessionClients);
+    }
+    sessionClients.set(serverName, { client, transport });
+};
+/**
+ * Get or create a per-session isolated upstream client for a server.
+ * Used when the server has `perSessionClient: true` in its config.
+ * Uses a creation lock to prevent duplicate connections from concurrent calls.
+ */
+const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
+    // Quick check without lock — already exists
+    const sessionClients = sessionIsolatedClients.get(sessionId);
+    if (sessionClients) {
+        const existing = sessionClients.get(serverInfo.name);
+        if (existing) {
+            return existing;
+        }
+    }
+    // Use a lock keyed by session+server to prevent concurrent duplicate creation
+    const lockKey = `${sessionId}:${serverInfo.name}`;
+    const existingLock = isolatedClientCreationLocks.get(lockKey);
+    if (existingLock) {
+        return existingLock;
+    }
+    const createPromise = (async () => {
+        // Re-check after acquiring the lock — another call may have created it
+        const sessionClientsAfterLock = sessionIsolatedClients.get(sessionId);
+        if (sessionClientsAfterLock) {
+            const existing = sessionClientsAfterLock.get(serverInfo.name);
+            if (existing) {
+                return existing;
+            }
+        }
+        const serverConfig = serverInfo.config;
+        if (!serverConfig) {
+            throw new Error(`Server config not found for isolated server: ${serverInfo.name}`);
+        }
+        if (!sessionIsolatedClients.has(sessionId)) {
+            sessionIsolatedClients.set(sessionId, new Map());
+        }
+        const reservedClients = sessionIsolatedClients.get(sessionId);
+        const transport = await createTransportFromConfig(serverInfo.name, serverConfig);
+        const client = createUpstreamMcpClient(serverInfo.name, () => serverInfo);
+        try {
+            await client.connect(transport, serverInfo.options || {});
+        }
+        catch (connectError) {
+            // Connect failed — close the client/transport and kill any spawned
+            // process tree so a failed handshake doesn't leak resources.
+            closeIsolatedClient(serverInfo.name, client, transport);
+            throw connectError;
+        }
+        // Guard: the session was cleaned up during the async connect if its map was
+        // deleted (identity no longer matches) — close the just-created connection.
+        if (sessionIsolatedClients.get(sessionId) !== reservedClients) {
+            console.warn(`Session ${sessionId} was deleted during isolated client creation for ${serverInfo.name}, closing new client`);
+            closeIsolatedClient(serverInfo.name, client, transport);
+            throw new Error(`Session ${sessionId} no longer exists`);
+        }
+        setSessionIsolatedClient(sessionId, serverInfo.name, client, transport);
+        console.log(`Created isolated client for session ${sessionId} -> ${serverInfo.name}`);
+        return { client, transport };
+    })();
+    isolatedClientCreationLocks.set(lockKey, createPromise);
+    // Release the lock once creation settles. The rejection itself is surfaced to
+    // (and handled by) the awaiting caller below; swallow it here so this
+    // bookkeeping chain never becomes an unhandled promise rejection.
+    void createPromise
+        .finally(() => {
+        isolatedClientCreationLocks.delete(lockKey);
+    })
+        .catch(() => undefined);
+    return createPromise;
 };
 export const notifyToolChanged = async (name, options) => {
     await registerAllTools(false, name, options);
@@ -325,6 +495,11 @@ const normalizeResourceForCache = (resource) => {
 };
 // Store all server information
 let serverInfos = [];
+// Per-session upstream clients for isolated servers (perSessionClient: true).
+// Map<sessionId, Map<serverName, { client, transport }>>
+const sessionIsolatedClients = new Map();
+// Locks to prevent concurrent creation of the same isolated client
+const isolatedClientCreationLocks = new Map();
 // Track servers pending a cache-refresh reinstall.
 // Consumed once by createTransportFromConfig on the next reconnect.
 const pendingReinstalls = new Set();
@@ -465,6 +640,10 @@ export const cleanupAllServers = () => {
         }
     }
     serverInfos = [];
+    // Drain all per-session isolated upstream clients (perSessionClient: true),
+    for (const sessionId of [...sessionIsolatedClients.keys()]) {
+        cleanupIsolatedSession(sessionId);
+    }
     // Clear session servers as well
     Object.keys(servers).forEach((sessionId) => {
         delete servers[sessionId];
@@ -806,51 +985,76 @@ export const createTransportFromConfig = async (name, conf) => {
     return transport;
 };
 // Helper function to handle client.callTool with reconnection logic
-const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries = 1) => {
-    if (!serverInfo.client) {
+const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries = 1, isolated) => {
+    // Local, reassignable refs so a reconnect can swap in the new connection for
+    // the next retry attempt. For isolated calls these track the per-session
+    // client/transport; otherwise they mirror the shared serverInfo connection.
+    let client = isolated ? isolated.client : serverInfo.client;
+    let transport = isolated ? isolated.transport : serverInfo.transport;
+    if (!client) {
         throw new Error(`Client not found for server: ${serverInfo.name}`);
     }
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
         try {
-            const result = await serverInfo.client.callTool(toolParams, undefined, options || {});
+            const result = await client.callTool(toolParams, undefined, options || {});
             // Check auth error
             checkAuthError(result);
             return result;
         }
         catch (error) {
             const isHttp40xError = isRecoverableHttp4xxError(error);
-            // Only retry for StreamableHTTPClientTransport
-            const isStreamableHttp = serverInfo.transport instanceof StreamableHTTPClientTransport;
-            const isSSE = serverInfo.transport instanceof SSEClientTransport;
-            if (attempt < maxRetries &&
-                serverInfo.transport &&
-                ((isStreamableHttp && isHttp40xError) || isSSE)) {
-                console.warn(`${isHttp40xError ? 'HTTP 40x error' : 'error'} detected for ${isStreamableHttp ? 'StreamableHTTP' : 'SSE'} server ${serverInfo.name}, attempting reconnection (attempt ${attempt + 1}/${maxRetries + 1})`);
+            // Only retry for StreamableHTTPClientTransport and SSE transports
+            const isStreamableHttp = transport instanceof StreamableHTTPClientTransport;
+            const isSSE = transport instanceof SSEClientTransport;
+            if (attempt < maxRetries && transport && ((isStreamableHttp && isHttp40xError) || isSSE)) {
+                console.warn(`${isHttp40xError ? 'HTTP 40x error' : 'error'} detected for ${isStreamableHttp ? 'StreamableHTTP' : 'SSE'} server ${serverInfo.name}${isolated ? ` (isolated session ${isolated.sessionId})` : ''}, attempting reconnection (attempt ${attempt + 1}/${maxRetries + 1})`);
                 try {
-                    // Close existing connection
-                    if (serverInfo.keepAliveIntervalId) {
-                        clearInterval(serverInfo.keepAliveIntervalId);
-                        serverInfo.keepAliveIntervalId = undefined;
-                    }
-                    serverInfo.client.close();
-                    serverInfo.transport.close();
                     const server = await getServerDao().findById(serverInfo.name);
                     if (!server) {
                         throw new Error(`Server configuration not found for: ${serverInfo.name}`);
                     }
-                    // Recreate transport using helper function
                     const newTransport = await createTransportFromConfig(serverInfo.name, server);
-                    // Create new client
-                    const client = createUpstreamMcpClient(serverInfo.name, () => serverInfo);
+                    const newClient = createUpstreamMcpClient(serverInfo.name, () => serverInfo);
                     // Reconnect with new transport
-                    await client.connect(newTransport, serverInfo.options || {});
-                    // Update server info with new client and transport
-                    serverInfo.client = client;
-                    serverInfo.transport = newTransport;
-                    serverInfo.status = 'connected';
+                    await newClient.connect(newTransport, serverInfo.options || {});
+                    if (isolated) {
+                        // Isolated path: close only this session's stale connection and
+                        // replace its entry in the per-session map. Never touch the shared
+                        // serverInfo client/transport.
+                        try {
+                            client.close();
+                        }
+                        catch { /* empty */ }
+                        try {
+                            transport.close();
+                        }
+                        catch { /* empty */ }
+                        setSessionIsolatedClient(isolated.sessionId, serverInfo.name, newClient, newTransport);
+                    }
+                    else {
+                        // Shared path: tear down and replace the shared connection.
+                        if (serverInfo.keepAliveIntervalId) {
+                            clearInterval(serverInfo.keepAliveIntervalId);
+                            serverInfo.keepAliveIntervalId = undefined;
+                        }
+                        try {
+                            serverInfo.client?.close();
+                        }
+                        catch { /* empty */ }
+                        try {
+                            transport.close();
+                        }
+                        catch { /* empty */ }
+                        serverInfo.client = newClient;
+                        serverInfo.transport = newTransport;
+                        serverInfo.status = 'connected';
+                    }
+                    // Point the local refs at the new connection for the next attempt.
+                    client = newClient;
+                    transport = newTransport;
                     // Reload tools list after reconnection
                     try {
-                        const tools = await client.listTools({}, serverInfo.options || {});
+                        const tools = await newClient.listTools({}, serverInfo.options || {});
                         updateServerToolsCache(serverInfo, tools.tools);
                     }
                     catch (listToolsError) {
@@ -869,8 +1073,10 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
                         serverName: serverInfo.name,
                         error: summarizeErrorForLogging(reconnectError),
                     });
-                    serverInfo.status = 'disconnected';
-                    serverInfo.error = `Failed to reconnect: ${formatErrorForLogging(reconnectError)}`;
+                    if (!isolated) {
+                        serverInfo.status = 'disconnected';
+                        serverInfo.error = `Failed to reconnect: ${formatErrorForLogging(reconnectError)}`;
+                    }
                     // If this was the last attempt, throw the original error
                     if (attempt === maxRetries) {
                         throw error;
@@ -935,17 +1141,25 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
             //   status. Reloading one server must not reconnect unrelated servers
             //   (e.g. failed/disconnected ones), which would also leak their
             //   previous stdio child processes. See #921.
-            // - a general/full initialization (no serverName) — only preserve this
-            //   server's state if it is already connected.
+            // - a general/full initialization (no serverName) — preserve this
+            //   server's state if it is already connected, or if an OAuth
+            //   authorization is in flight. Reconnecting during PKCE authorization
+            //   would replace the pending code verifier and break the callback.
             const existingServer = existingServerInfos.find((s) => s.name === name);
             const isDifferentServer = Boolean(serverName) && serverName !== name;
+            const hasInflightOAuthAuthorization = existingServer?.status === 'oauth_required' &&
+                Boolean(expandedConf.oauth?.pendingAuthorization?.state ||
+                    existingServer.oauth?.state);
             if (existingServer &&
-                (isDifferentServer || (!serverName && existingServer.status === 'connected'))) {
+                (isDifferentServer ||
+                    (!serverName && (existingServer.status === 'connected' || hasInflightOAuthAuthorization)))) {
                 nextServerInfos.push({
                     ...existingServer,
                     enabled: expandedConf.enabled === undefined ? true : expandedConf.enabled,
                 });
-                console.log(`Server '${name}' is already connected.`);
+                console.log(hasInflightOAuthAuthorization
+                    ? `Server '${name}' has an in-flight OAuth authorization; preserving existing state.`
+                    : `Server '${name}' is already connected.`);
                 continue;
             }
             let transport;
@@ -1264,6 +1478,7 @@ export const getServersInfo = async (page, limit, user) => {
         const serverConfig = allServers.find((server) => server.name === name);
         const enabled = serverConfig ? serverConfig.enabled !== false : true;
         const resolvedType = inferServerType(serverConfig);
+        const oauthConnected = Boolean(serverConfig?.oauth?.accessToken || serverConfig?.oauth?.refreshToken);
         // Add enabled status and custom description to each tool
         const toolsWithEnabled = tools.map((tool) => {
             const toolConfig = serverConfig?.tools?.[tool.name];
@@ -1290,11 +1505,16 @@ export const getServersInfo = async (page, limit, user) => {
             resources,
             createTime,
             enabled,
-            oauth: oauth
+            oauth: oauth || oauthConnected
                 ? {
-                    authorizationUrl: oauth.authorizationUrl,
-                    state: oauth.state,
-                    // Don't expose codeVerifier to frontend for security
+                    ...(oauth
+                        ? {
+                            authorizationUrl: oauth.authorizationUrl,
+                            state: oauth.state,
+                            // Don't expose codeVerifier to frontend for security
+                        }
+                        : {}),
+                    ...(oauthConnected ? { connected: true } : {}),
                 }
                 : undefined,
             config: resolvedType || serverConfig?.description || serverConfig?.command
@@ -1494,31 +1714,61 @@ function checkAuthError(result) {
         }
     }
 }
+const closeServerRuntime = (serverInfo) => {
+    if (serverInfo.keepAliveIntervalId) {
+        clearInterval(serverInfo.keepAliveIntervalId);
+        serverInfo.keepAliveIntervalId = undefined;
+        console.log('Cleared MCP server keep-alive interval');
+    }
+    const candidateTransport = serverInfo.transport;
+    const stdioPid = typeof candidateTransport?.pid === 'number' ? candidateTransport.pid : null;
+    if (serverInfo.client) {
+        try {
+            serverInfo.client.close();
+        }
+        catch {
+            console.warn('Error closing MCP client during runtime shutdown');
+        }
+        serverInfo.client = undefined;
+    }
+    if (serverInfo.transport) {
+        try {
+            serverInfo.transport.close();
+        }
+        catch {
+            console.warn('Error closing MCP transport during runtime shutdown');
+        }
+        serverInfo.transport = undefined;
+    }
+    if (stdioPid) {
+        killStdioProcessTree(serverInfo.name, stdioPid);
+    }
+    console.log('Closed MCP server client and transport');
+};
 // Close server client and transport
 function closeServer(name) {
     const serverInfo = serverInfos.find((serverInfo) => serverInfo.name === name);
-    if (serverInfo && serverInfo.client && serverInfo.transport) {
-        // Clear keep-alive interval if exists
-        if (serverInfo.keepAliveIntervalId) {
-            clearInterval(serverInfo.keepAliveIntervalId);
-            serverInfo.keepAliveIntervalId = undefined;
-            console.log(`Cleared keep-alive interval for server: ${serverInfo.name}`);
-        }
-        // Capture the child PID via duck-typing. `instanceof StdioClientTransport`
-        // is unreliable under pnpm's "dual package hazard" — a different copy of
-        // @modelcontextprotocol/sdk in node_modules makes the check return false
-        // even for genuine stdio transports. The `pid` getter is the SDK's public
-        // contract, so checking for it is both safer and version-agnostic.
-        const candidateTransport = serverInfo.transport;
-        const stdioPid = typeof candidateTransport.pid === 'number' ? candidateTransport.pid : null;
-        serverInfo.client.close();
-        serverInfo.transport.close();
-        if (stdioPid) {
-            killStdioProcessTree(name, stdioPid);
-        }
-        console.log(`Closed client and transport for server: ${serverInfo.name}`);
+    if (serverInfo) {
+        closeServerRuntime(serverInfo);
     }
 }
+export const resetServerOAuthConnection = (name) => {
+    const serverInfo = serverInfos.find((serverInfo) => serverInfo.name === name);
+    if (!serverInfo) {
+        return false;
+    }
+    closeServerRuntime(serverInfo);
+    serverInfo.status = 'oauth_required';
+    serverInfo.error = null;
+    serverInfo.tools = [];
+    serverInfo.prompts = [];
+    serverInfo.resources = [];
+    serverInfo.oauth = undefined;
+    broadcastToolListChanged();
+    broadcastPromptListChanged();
+    broadcastResourceListChanged();
+    return true;
+};
 // Kill the entire process tree of a stdio transport's child process.
 //
 // transport.close() only sends SIGTERM to the direct child. When the server is
@@ -1944,8 +2194,13 @@ export const handleCallToolRequest = async (request, extra) => {
                 });
             }
             // Call the tool on the target server (MCP servers)
-            const client = targetServerInfo.client;
-            if (!client) {
+            // For servers with perSessionClient: true, use a per-session dedicated client
+            let isolatedCtx;
+            if (targetServerInfo.config?.perSessionClient && sessionId) {
+                const isolated = await getOrCreateIsolatedClient(sessionId, targetServerInfo);
+                isolatedCtx = { sessionId, client: isolated.client, transport: isolated.transport };
+            }
+            else if (!targetServerInfo.client) {
                 throw new Error(`Client not found for server: ${targetServerInfo.name}`);
             }
             // Use toolArgs if it has properties, otherwise fallback to request.params.arguments
@@ -1954,13 +2209,14 @@ export const handleCallToolRequest = async (request, extra) => {
                 toolName: targetToolName,
                 serverName: targetServerInfo.name,
                 arguments: summarizeArgumentsForLogging(finalArgs),
+                perSessionClient: !!targetServerInfo.config?.perSessionClient,
             });
             const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, targetToolName);
             await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
             const result = await callToolWithReconnect(targetServerInfo, {
                 name: cleanToolName,
                 arguments: finalArgs,
-            }, targetServerInfo.options || {});
+            }, targetServerInfo.options || {}, 1, isolatedCtx);
             await settleHostedIfNeeded({
                 success: !result.isError,
                 requestContent: finalArgs,
@@ -2088,13 +2344,18 @@ export const handleCallToolRequest = async (request, extra) => {
             });
         }
         // Handle MCP servers
-        const client = serverInfo.client;
-        if (!client) {
+        // For servers with perSessionClient: true, use a per-session dedicated client
+        let isolatedCtx;
+        if (serverInfo.config?.perSessionClient && sessionId) {
+            const isolated = await getOrCreateIsolatedClient(sessionId, serverInfo);
+            isolatedCtx = { sessionId, client: isolated.client, transport: isolated.transport };
+        }
+        else if (!serverInfo.client) {
             throw new Error(`Client not found for server: ${serverInfo.name}`);
         }
         const cleanToolName = normalizeToolNameForServer(serverInfo.name, routeToolName);
         await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-        const result = await callToolWithReconnect(serverInfo, { ...request.params, name: cleanToolName }, serverInfo.options || {});
+        const result = await callToolWithReconnect(serverInfo, { ...request.params, name: cleanToolName }, serverInfo.options || {}, 1, isolatedCtx);
         await settleHostedIfNeeded({
             success: !result.isError,
             requestContent: request.params.arguments,