@yamo/mcp-server 1.3.1 → 1.3.4

package/dist/index.js

@@ -47,6 +47,14 @@ const crypto_1 = __importDefault(require("crypto"));
 const path_1 = __importDefault(require("path"));
 const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(__dirname, '../package.json'), 'utf8'));
 dotenv.config();
+// Validation helper for bytes32 hashes (Part 3: Security Fixes)
+function validateBytes32(value, fieldName) {
+    if (!value.match(/^0x[a-fA-F0-9]{64}$/)) {
+        throw new Error(`${fieldName} must be a valid bytes32 hash (0x + 64 hex chars). ` +
+            `Received: ${value.substring(0, 20)}...` +
+            `\nDo NOT include algorithm prefixes like "sha256:"`);
+    }
+}
 const SUBMIT_BLOCK_TOOL = {
     name: "yamo_submit_block",
     description: `Submits a YAMO block to the YAMORegistry smart contract.
@@ -58,12 +66,15 @@ const SUBMIT_BLOCK_TOOL = {
 - contentHash: Must be a valid bytes32 hash (32 bytes = 64 hex characters)
   • Format: "0x" followed by exactly 64 hexadecimal characters
   • Do NOT include algorithm prefixes (e.g., "sha256:")
-- previousBlock: For genesis block use: 0x0000000000000000000000000000000000000000000000000000000000000000
+- previousBlock: Content hash of parent block.
+  • If omitted, automatically fetches the latest block's contentHash
+  • For genesis block: 0x0000000000000000000000000000000000000000000000000000000000000000
 
 **Transaction Flow:**
-1. Content and files are uploaded to IPFS (if provided)
-2. Block is submitted to smart contract with hash reference
-3. Returns transaction hash and IPFS CID`,
+1. If previousBlock omitted, fetches latest block from chain automatically
+2. Content and files are uploaded to IPFS (if provided)
+3. Block is submitted to smart contract with hash reference
+4. Returns transaction hash and IPFS CID`,
     inputSchema: {
         type: "object",
         properties: {
@@ -74,7 +85,7 @@ const SUBMIT_BLOCK_TOOL = {
             previousBlock: {
                 type: "string",
                 pattern: "^0x[a-fA-F0-9]{64}$",
-                description: "Content hash of parent block. Genesis: 0x0000...0000"
+                description: "Content hash of parent block. If omitted, auto-fetched from latest block. Use 0x0000...0000 for genesis."
             },
             contentHash: {
                 type: "string",
@@ -111,7 +122,7 @@ const SUBMIT_BLOCK_TOOL = {
                 description: "Optional: Output files to bundle. Content can be file path (auto-read) or actual content."
             }
         },
-        required: ["blockId", "previousBlock", "contentHash", "consensusType", "ledger"],
+        required: ["blockId", "contentHash", "consensusType", "ledger"],
     },
 };
 const GET_BLOCK_TOOL = {
@@ -144,6 +155,33 @@ Use for:
         required: ["blockId"],
     },
 };
+const GET_LATEST_BLOCK_TOOL = {
+    name: "yamo_get_latest_block",
+    description: `Retrieves the most recently submitted YAMO block from the blockchain.
+
+Queries BlockSubmitted events to find the block with the highest timestamp,
+then fetches its full details including the contentHash that should be used
+as previousBlock for the next submission.
+
+Returns:
+- blockId: Unique block identifier
+- previousBlock: Content hash of parent block
+- agentAddress: Ethereum address of submitter
+- contentHash: 32-byte hash stored on-chain (use as previousBlock for next submission)
+- timestamp: Block submission timestamp (Unix epoch)
+- consensusType: Consensus mechanism used
+- ledger: Distributed storage reference
+- ipfsCID: IPFS CID if content was anchored
+
+Use for:
+- Automatically getting the chain tip for extending the chain
+- Fetching the contentHash to use as previousBlock in submitBlock
+- Discovering the latest block without knowing its ID`,
+    inputSchema: {
+        type: "object",
+        properties: {},
+    },
+};
 const AUDIT_BLOCK_TOOL = {
     name: "yamo_audit_block",
     description: `Performs cryptographic integrity audit of a block.
@@ -212,6 +250,8 @@ class YamoMcpServer {
     server;
     ipfs;
     chain;
+    // Cache for chain continuation: latest submitted block's contentHash
+    latestContentHash = null;
     constructor() {
         this.server = new index_js_1.Server({ name: "yamo", version: pkg.version }, { capabilities: { tools: {} } });
         this.ipfs = new core_1.IpfsManager();
@@ -220,29 +260,64 @@ class YamoMcpServer {
     }
     setupHandlers() {
         this.server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-            tools: [SUBMIT_BLOCK_TOOL, GET_BLOCK_TOOL, AUDIT_BLOCK_TOOL, VERIFY_BLOCK_TOOL],
+            tools: [SUBMIT_BLOCK_TOOL, GET_BLOCK_TOOL, GET_LATEST_BLOCK_TOOL, AUDIT_BLOCK_TOOL, VERIFY_BLOCK_TOOL],
         }));
         this.server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             const { name, arguments: args } = request.params;
             try {
                 if (name === "yamo_submit_block") {
                     const { blockId, previousBlock, contentHash, consensusType, ledger, content, files, encryptionKey } = args;
-                    // Process files - auto-read if they're file paths
+                    // Process files - auto-read if they're file paths (with security fix)
                     let processedFiles = files;
                     if (files && Array.isArray(files)) {
                         processedFiles = files.map((file) => {
                             // Check if content is a file path that exists
                             if (typeof file.content === 'string' && fs_1.default.existsSync(file.content)) {
+                                // Security: Resolve to absolute path and restrict to cwd (Part 3: Security Fixes)
+                                const filePath = path_1.default.resolve(file.content);
+                                const allowedDir = process.cwd();
+                                if (!filePath.startsWith(allowedDir)) {
+                                    throw new Error(`File path outside allowed directory: ${file.content}`);
+                                }
                                 console.error(`[DEBUG] Auto-reading file from path: ${file.content}`);
                                 return {
                                     name: file.name,
-                                    content: fs_1.default.readFileSync(file.content, 'utf8')
+                                    content: fs_1.default.readFileSync(filePath, 'utf8')
                                 };
                             }
                             // Otherwise use content as-is
                             return file;
                         });
                     }
+                    // Input validation (Part 3: Security Fixes)
+                    validateBytes32(contentHash, "contentHash");
+                    // Auto-fetch previousBlock if not provided
+                    let resolvedPreviousBlock = previousBlock;
+                    if (!resolvedPreviousBlock) {
+                        console.error(`[INFO] No previousBlock provided, fetching latest block from chain...`);
+                        // First, try the cache (most reliable for chain continuation)
+                        if (this.latestContentHash) {
+                            resolvedPreviousBlock = this.latestContentHash;
+                            console.error(`[INFO] Using cached latest block's contentHash: ${resolvedPreviousBlock}`);
+                        }
+                        else {
+                            // Fallback to chain query (for first run or if cache was cleared)
+                            const latestBlock = await this.chain.getLatestBlock();
+                            if (latestBlock) {
+                                resolvedPreviousBlock = latestBlock.contentHash;
+                                this.latestContentHash = latestBlock.contentHash; // Update cache
+                                console.error(`[INFO] Using latest block's contentHash from chain: ${resolvedPreviousBlock}`);
+                            }
+                            else {
+                                // No blocks exist yet, use genesis
+                                resolvedPreviousBlock = "0x0000000000000000000000000000000000000000000000000000000000000000";
+                                console.error(`[INFO] No existing blocks found, using genesis`);
+                            }
+                        }
+                    }
+                    else {
+                        validateBytes32(previousBlock, "previousBlock");
+                    }
                     let ipfsCID = undefined;
                     if (content) {
                         ipfsCID = await this.ipfs.upload({
@@ -251,13 +326,23 @@ class YamoMcpServer {
                             encryptionKey
                         });
                     }
-                    const txHash = await this.chain.submitBlock(blockId, previousBlock, contentHash, consensusType, ledger, ipfsCID);
+                    const tx = await this.chain.submitBlock(blockId, resolvedPreviousBlock, contentHash, consensusType, ledger, ipfsCID);
+                    const receipt = await tx.wait();
+                    // Update cache with the new block's contentHash for chain continuation
+                    this.latestContentHash = contentHash;
+                    console.error(`[INFO] Updated latestContentHash cache: ${contentHash}`);
                     return {
                         content: [{ type: "text", text: JSON.stringify({
                                     success: true,
                                     blockId,
-                                    transactionHash: txHash,
-                                    ipfsCID: ipfsCID || null
+                                    transactionHash: tx.hash,
+                                    blockNumber: receipt.blockNumber,
+                                    gasUsed: receipt.gasUsed.toString(),
+                                    effectiveGasPrice: receipt.effectiveGasPrice?.toString(),
+                                    ipfsCID: ipfsCID || null,
+                                    previousBlock: resolvedPreviousBlock,
+                                    contractAddress: this.chain.getContractAddress(),
+                                    timestamp: new Date().toISOString()
                                 }, null, 2) }],
                     };
                 }
@@ -292,6 +377,35 @@ class YamoMcpServer {
                                 }, null, 2) }],
                     };
                 }
+                if (name === "yamo_get_latest_block") {
+                    const latestBlock = await this.chain.getLatestBlock();
+                    if (!latestBlock) {
+                        return {
+                            content: [{ type: "text", text: JSON.stringify({
+                                        success: false,
+                                        error: "No blocks found on-chain",
+                                        hint: "The chain may be empty. Try submitting a genesis block first."
+                                    }, null, 2) }],
+                            isError: false,
+                        };
+                    }
+                    return {
+                        content: [{ type: "text", text: JSON.stringify({
+                                    success: true,
+                                    block: {
+                                        blockId: latestBlock.blockId,
+                                        previousBlock: latestBlock.previousBlock,
+                                        agentAddress: latestBlock.agentAddress,
+                                        contentHash: latestBlock.contentHash,
+                                        timestamp: latestBlock.timestamp,
+                                        timestampISO: new Date(latestBlock.timestamp * 1000).toISOString(),
+                                        consensusType: latestBlock.consensusType,
+                                        ledger: latestBlock.ledger,
+                                        ipfsCID: latestBlock.ipfsCID || null
+                                    }
+                                }, null, 2) }],
+                    };
+                }
                 if (name === "yamo_audit_block") {
                     const { blockId, encryptionKey } = args;
                     // Get block from chain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yamo/mcp-server",
-  "version": "1.3.1",
+  "version": "1.3.4",
   "description": "YAMO Protocol v0.4 - Model Context Protocol server for AI agents",
   "main": "dist/index.js",
   "type": "commonjs",
@@ -17,7 +17,9 @@
     "build": "tsc",
     "prepublishOnly": "npm run build",
     "start": "node dist/index.js",
-    "dev": "ts-node src/index.ts"
+    "dev": "ts-node src/index.ts",
+    "test": "node --test test/**/*.test.js",
+    "test:security": "node --test test/security.test.js"
   },
   "keywords": [
     "yamo",
@@ -43,7 +45,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.25.1",
-    "@yamo/core": "^1.1.0",
+    "@yamo/core": "^1.2.7",
     "axios": "^1.13.2",
     "dotenv": "^17.2.3",
     "form-data": "^4.0.5"