@wrongstack/mcp 0.317.2 → 0.319.0

package/dist/index.js

@@ -817,10 +817,11 @@ function boundedServerName(value) {
 
 // src/client.ts
 import { spawn as spawn2 } from "node:child_process";
-import { buildChildEnv, buildWin32CmdShimInvocation, toErrorMessage } from "@wrongstack/core/utils";
+import { buildChildEnv as buildChildEnv2, buildWin32CmdShimInvocation, toErrorMessage } from "@wrongstack/core/utils";
 
 // src/client-process.ts
 import { spawn } from "node:child_process";
+import { buildChildEnv } from "@wrongstack/core/utils";
 function forceKillTree(child) {
   if (child.pid === void 0) {
     try {
@@ -832,6 +833,9 @@ function forceKillTree(child) {
   if (process.platform === "win32") {
     const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
       stdio: "ignore",
+      // H-8 convention (spawn-convention test): taskkill needs PATH only —
+      // do not hand it the credential-bearing parent environment.
+      env: buildChildEnv(),
       windowsHide: true
     });
     killer.once("error", () => {
@@ -2284,7 +2288,7 @@ var MCPClient = class _MCPClient {
     }
     const isWin = process.platform === "win32";
     const rawArgs = this.opts.args ?? [];
-    const spawnEnv = buildChildEnv({ extra: extraEnv });
+    const spawnEnv = buildChildEnv2({ extra: extraEnv });
     const stdio = ["pipe", "pipe", "pipe"];
     const child = isWin ? (() => {
       const shim = buildWin32CmdShimInvocation(this.opts.command, rawArgs);
@@ -3036,6 +3040,15 @@ async function persist(configPath, full, servers) {
   full.mcpServers = servers;
   await writeConfig(configPath, full);
 }
+var UNSAFE_SERVER_NAMES = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function unsafeServerNameResult(name) {
+  if (!UNSAFE_SERVER_NAMES.has(name)) return void 0;
+  return { ok: false, message: `Invalid server name "${name}"` };
+}
 function normalizeTransport(t) {
   if (t === "sse") return "sse";
   if (t === "http" || t === "streamable-http") return "streamable-http";
@@ -3124,11 +3137,13 @@ async function listMcp(deps) {
 }
 async function addMcp(input, deps) {
   if (!input.name) return { ok: false, message: "Server name is required" };
+  const unsafe = unsafeServerNameResult(input.name);
+  if (unsafe) return unsafe;
   const { full, servers } = await readServers(deps.configPath);
-  if (servers[input.name]) {
+  if (Object.hasOwn(servers, input.name)) {
     return { ok: false, message: `Server "${input.name}" already exists` };
   }
-  const preset = deps.presets?.[input.name];
+  const preset = deps.presets && Object.hasOwn(deps.presets, input.name) ? deps.presets[input.name] : void 0;
   const hasExplicitConfig = !!(input.transport || input.command || input.url);
   const cfg = hasExplicitConfig ? buildConfig(input, preset) : preset ? buildConfig({ ...input, name: input.name }, preset) : buildConfig(input);
   if (!hasExplicitConfig && !preset) {
@@ -3153,7 +3168,12 @@ async function addMcp(input, deps) {
 }
 async function updateMcp(input, deps) {
   if (!input.name) return { ok: false, message: "Server name is required" };
+  const unsafe = unsafeServerNameResult(input.name);
+  if (unsafe) return unsafe;
   const { full, servers } = await readServers(deps.configPath);
+  if (!Object.hasOwn(servers, input.name)) {
+    return { ok: false, message: `Server "${input.name}" not found` };
+  }
   const existing = servers[input.name];
   if (!existing) return { ok: false, message: `Server "${input.name}" not found` };
   const cfg = buildConfig(input, { ...existing, name: input.name });
@@ -3172,8 +3192,10 @@ async function updateMcp(input, deps) {
 }
 async function removeMcp(name, deps) {
   if (!name) return { ok: false, message: "Server name is required" };
+  const unsafe = unsafeServerNameResult(name);
+  if (unsafe) return unsafe;
   const { full, servers } = await readServers(deps.configPath);
-  if (!servers[name]) return { ok: false, message: `Server "${name}" not found` };
+  if (!Object.hasOwn(servers, name)) return { ok: false, message: `Server "${name}" not found` };
   await safeStop(name, deps);
   forgetRegistryState(deps.registry, name);
   delete servers[name];
@@ -3182,7 +3204,12 @@ async function removeMcp(name, deps) {
 }
 async function enableMcp(name, deps) {
   if (!name) return { ok: false, message: "Server name is required" };
+  const unsafe = unsafeServerNameResult(name);
+  if (unsafe) return unsafe;
   const { full, servers } = await readServers(deps.configPath);
+  if (!Object.hasOwn(servers, name)) {
+    return { ok: false, message: `Server "${name}" is not in config. Add it first.` };
+  }
   const cfg = servers[name];
   if (!cfg) {
     return { ok: false, message: `Server "${name}" is not in config. Add it first.` };
@@ -3194,7 +3221,12 @@ async function enableMcp(name, deps) {
 }
 async function disableMcp(name, deps) {
   if (!name) return { ok: false, message: "Server name is required" };
+  const unsafe = unsafeServerNameResult(name);
+  if (unsafe) return unsafe;
   const { full, servers } = await readServers(deps.configPath);
+  if (!Object.hasOwn(servers, name)) {
+    return { ok: false, message: `Server "${name}" is not in config.` };
+  }
   const cfg = servers[name];
   if (!cfg) return { ok: false, message: `Server "${name}" is not in config.` };
   await safeStop(name, deps);
@@ -3210,6 +3242,8 @@ async function disableMcp(name, deps) {
 }
 async function restartMcp(name, deps) {
   if (!name) return { ok: false, message: "Server name is required" };
+  const unsafe = unsafeServerNameResult(name);
+  if (unsafe) return unsafe;
   const registered = deps.registry.list().some((s) => s.name === name);
   if (registered) {
     try {
@@ -3221,6 +3255,9 @@ async function restartMcp(name, deps) {
     }
   }
   const { servers } = await readServers(deps.configPath);
+  if (!Object.hasOwn(servers, name)) {
+    return { ok: false, message: `Server "${name}" is not in config.` };
+  }
   const cfg = servers[name];
   if (!cfg) return { ok: false, message: `Server "${name}" is not in config.` };
   return startServer(name, { ...cfg, name }, deps, `Server "${name}" started`, { restart: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "0.317.2",
+  "version": "0.319.0",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -26,7 +26,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "0.317.2"
+    "@wrongstack/core": "0.319.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",