@yawlabs/aws-mcp 0.9.9 → 0.9.10

package/dist/index.js

@@ -53570,6 +53570,14 @@ function killProc(proc, escalationMs = KILL_ESCALATION_MS) {
 // src/session.ts
 var sessionProfile;
 var sessionRegion;
+var PROFILE_NAME_RE = /^[A-Za-z0-9_+,.@:][A-Za-z0-9_+=,.@:-]{0,127}$/;
+var REGION_NAME_RE = /^[a-z][a-z0-9-]{2,30}$/;
+function isValidProfileName(name) {
+  return PROFILE_NAME_RE.test(name);
+}
+function isValidRegionName(name) {
+  return REGION_NAME_RE.test(name);
+}
 function getProfile() {
   return sessionProfile ?? process.env.AWS_PROFILE ?? "default";
 }
@@ -53580,13 +53588,25 @@ function setProfile(name) {
   if (!name?.trim()) {
     throw new Error("Profile name cannot be empty");
   }
-  sessionProfile = name.trim();
+  const trimmed = name.trim();
+  if (!isValidProfileName(trimmed)) {
+    throw new Error(
+      `Invalid profile name '${trimmed}'. Must be 1-128 chars from [A-Za-z0-9_+=,.@:-], must not start with '-' or '=', no whitespace or shell metacharacters.`
+    );
+  }
+  sessionProfile = trimmed;
 }
 function setRegion(name) {
   if (!name?.trim()) {
     throw new Error("Region cannot be empty");
   }
-  sessionRegion = name.trim();
+  const trimmed = name.trim();
+  if (!isValidRegionName(trimmed)) {
+    throw new Error(
+      `Invalid region '${trimmed}'. Must match /^[a-z][a-z0-9-]{2,30}$/ (e.g. 'us-east-1', 'eu-west-3').`
+    );
+  }
+  sessionRegion = trimmed;
 }
 function clearProfile() {
   sessionProfile = void 0;
@@ -53672,6 +53692,20 @@ function runAwsCall(opts) {
   }
   const profile = opts.profile ?? getProfile();
   const region = opts.region ?? getRegion();
+  if (!isValidProfileName(profile)) {
+    return Promise.resolve({
+      ok: false,
+      kind: "bad_input",
+      error: `Invalid profile name '${profile}'. Must be 1-128 chars from [A-Za-z0-9_+=,.@:-], must not start with '-' or '='. Check the 'profile' arg or AWS_PROFILE env var.`
+    });
+  }
+  if (!isValidRegionName(region)) {
+    return Promise.resolve({
+      ok: false,
+      kind: "bad_input",
+      error: `Invalid region '${region}'. Must match /^[a-z][a-z0-9-]{2,30}$/ (e.g. 'us-east-1'). Check the 'region' arg or AWS_REGION / AWS_DEFAULT_REGION env var.`
+    });
+  }
   const outputFormat = opts.outputFormat ?? "json";
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const envCommand = process.env.AWS_MCP_TEST_AWS_COMMAND;
@@ -53942,18 +53976,25 @@ async function acquireLock(lockPath) {
         `upsertProfile: failed to acquire lock at ${lockPath} after ${LOCK_MAX_WAIT_MS}ms. If a previous writer crashed, remove the lock file manually.`
       );
     }
+    let fd = null;
     try {
-      const fd = openSync(lockPath, "wx");
-      try {
-        writeSync(fd, `pid=${process.pid} time=${Date.now()}
-`);
-      } finally {
-        closeSync(fd);
-      }
-      return;
+      fd = openSync(lockPath, "wx");
     } catch (err) {
       const code = err.code;
       if (code !== "EEXIST") {
+        throw err;
+      }
+    }
+    if (fd !== null) {
+      try {
+        try {
+          writeSync(fd, `pid=${process.pid} time=${Date.now()}
+`);
+        } finally {
+          closeSync(fd);
+        }
+        return;
+      } catch (err) {
         try {
           unlinkSync(lockPath);
         } catch {
@@ -54051,6 +54092,12 @@ var assumeTools = [
       const sourceProfile = i.sourceProfile || getProfile();
       const useRegion = i.region || getRegion();
       const targetProfile = resolveTargetProfile({ targetProfile: i.targetProfile, sessionName: i.sessionName });
+      if (!isValidProfileName(targetProfile)) {
+        return {
+          ok: false,
+          error: `Invalid targetProfile name '${targetProfile}'. Must be 1-128 chars from [A-Za-z0-9_+=,.@:-], must not start with '-' or '='. Pick a different targetProfile or sessionName.`
+        };
+      }
       const params = {
         RoleArn: i.roleArn,
         RoleSessionName: i.sessionName,
@@ -54142,6 +54189,12 @@ function _ttlKillswitchTick(s, proc, killFn = killProc) {
   killFn(proc);
 }
 function startSsoLogin(profile, opts = {}) {
+  if (!isValidProfileName(profile)) {
+    return Promise.resolve({
+      ok: false,
+      error: `Invalid profile name '${profile}'. Must be 1-128 chars from [A-Za-z0-9_+=,.@:-], must not start with '-' or '='.`
+    });
+  }
   const key = dedupeKey(profile, opts);
   const pending = pendingStarts.get(key);
   if (pending) return pending;
@@ -56473,13 +56526,16 @@ async function runScript(opts, handlers = defaultScriptHandlers()) {
 ${opts.code}
 })()`;
   const started = Date.now();
-  let timer;
+  let timeoutReject;
   const timeoutPromise = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      reject(new Error(`Script timed out after ${Math.round(timeoutMs / 1e3)}s. Raise timeoutMs or trim the script.`));
-    }, timeoutMs);
+    timeoutReject = reject;
   });
-  if (timer && typeof timer.unref === "function") timer.unref();
+  const timer = setTimeout(() => {
+    timeoutReject(
+      new Error(`Script timed out after ${Math.round(timeoutMs / 1e3)}s. Raise timeoutMs or trim the script.`)
+    );
+  }, timeoutMs);
+  timer.unref();
   try {
     const evalResult = runInContext(wrappedSource, ctx, {
       timeout: timeoutMs,
@@ -56488,7 +56544,7 @@ ${opts.code}
     const data = await Promise.race([evalResult, timeoutPromise]);
     return { data, logs, truncatedLogs, durationMs: Date.now() - started };
   } finally {
-    if (timer) clearTimeout(timer);
+    clearTimeout(timer);
   }
 }
 var scriptTools = [
@@ -56607,7 +56663,7 @@ var sessionTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.9.9" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.9.10" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/aws-mcp",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "mcpName": "io.github.YawLabs/aws-mcp",
   "description": "AWS MCP server — call any AWS API from AI assistants, with first-class SSO re-login (no more 'browser won't open' dead ends)",
   "license": "MIT",