@yawlabs/ssh-mcp 0.11.5 → 0.12.0

package/dist/index.js

@@ -214,8 +214,6 @@ function checkSshConfig(host) {
         if (inHostBlock) hostConfig.push(trimmed);
       } else if (inHostBlock && trimmed) {
         hostConfig.push(trimmed);
-      } else if (inHostBlock && !trimmed) {
-        inHostBlock = false;
       }
     }
     if (hostConfig.length === 0) {
@@ -615,7 +613,15 @@ import { readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 import { Client } from "ssh2";
+var sshConfigCache = /* @__PURE__ */ new Map();
 function resolveFromSshConfig(host) {
+  const cached = sshConfigCache.get(host);
+  if (cached !== void 0) return cached;
+  const result = resolveFromSshConfigUncached(host);
+  sshConfigCache.set(host, result);
+  return result;
+}
+function resolveFromSshConfigUncached(host) {
   try {
     const { stdout, ok } = runArgs("ssh", ["-G", host]);
     if (!ok) return null;
@@ -695,8 +701,10 @@ function resolveConfig(config) {
     keepaliveCountMax: 3,
     hostVerifier: buildHostVerifier(verifierHosts, port)
   };
+  const home = homedir3();
   if (config.privateKeyPath) {
-    connectConfig.privateKey = readFileSync3(config.privateKeyPath);
+    const keyPath = config.privateKeyPath.startsWith("~") ? join3(home, config.privateKeyPath.slice(1)) : config.privateKeyPath;
+    connectConfig.privateKey = readFileSync3(keyPath);
   } else if (config.password) {
     connectConfig.password = config.password;
   } else {
@@ -704,7 +712,6 @@ function resolveConfig(config) {
     if (agentSock) {
       connectConfig.agent = agentSock;
     }
-    const home = homedir3();
     const keyPaths = sshConfig && sshConfig.identityFiles.length > 0 ? sshConfig.identityFiles.map((p) => p.startsWith("~") ? join3(home, p.slice(1)) : p) : [join3(home, ".ssh", "id_ed25519"), join3(home, ".ssh", "id_rsa"), join3(home, ".ssh", "id_ecdsa")];
     for (const keyPath of keyPaths) {
       try {
@@ -941,10 +948,11 @@ async function writeFile(client, remotePath, content) {
   }
 }
 async function uploadFile(client, localPath, remotePath) {
+  const resolvedLocal = localPath.startsWith("~") ? join3(homedir3(), localPath.slice(1)) : localPath;
   const sftp = await getSftp(client);
   try {
     await new Promise((resolve, reject) => {
-      sftp.fastPut(localPath, remotePath, (err) => {
+      sftp.fastPut(resolvedLocal, remotePath, (err) => {
         if (err) return reject(err);
         resolve();
       });
@@ -954,10 +962,11 @@ async function uploadFile(client, localPath, remotePath) {
   }
 }
 async function downloadFile(client, remotePath, localPath) {
+  const resolvedLocal = localPath.startsWith("~") ? join3(homedir3(), localPath.slice(1)) : localPath;
   const sftp = await getSftp(client);
   try {
     await new Promise((resolve, reject) => {
-      sftp.fastGet(remotePath, localPath, (err) => {
+      sftp.fastGet(remotePath, resolvedLocal, (err) => {
         if (err) return reject(err);
         resolve();
       });
@@ -1296,16 +1305,16 @@ async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
     };
   });
 }
-var VALID_FIND_SIZE = /^\d+[kMGTP]?$/;
+var VALID_FIND_SIZE = /^\d+[cwbkMG]?$/;
 async function find(client, options, timeoutMs = 3e4) {
   if (options.minsize && !VALID_FIND_SIZE.test(options.minsize)) {
     throw new Error(
-      `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional k/M/G/T/P (e.g. "1M", "100k")`
+      `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "1M", "100k")`
     );
   }
   if (options.maxsize && !VALID_FIND_SIZE.test(options.maxsize)) {
     throw new Error(
-      `Invalid maxsize format: "${options.maxsize}". Expected: digits followed by optional k/M/G/T/P (e.g. "10M", "500k")`
+      `Invalid maxsize format: "${options.maxsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "10M", "500k")`
     );
   }
   const args = ["--", shellQuote(options.path)];
@@ -1386,6 +1395,9 @@ function enforcePolicy(command) {
 
 // src/tools.ts
 var HostSchema = z.string().describe("SSH hostname or IP address");
+var AbsoluteRemotePathSchema = z.string().refine((p) => p.startsWith("/"), {
+  message: "Path must be absolute (start with /). SFTP does not expand ~ or resolve relative paths through a shell."
+});
 var PortSchema = z.number().int().min(1).max(65535).optional().describe("SSH port (default: 22)");
 var UsernameSchema = z.string().optional().describe("SSH username (default: current user)");
 var KeyPathSchema = z.string().optional().describe("Path to SSH private key");
@@ -1453,7 +1465,7 @@ ${result.stderr}`);
     "Write content to a file on a remote host via SFTP. Creates or overwrites the file.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path to the remote file"),
+      path: AbsoluteRemotePathSchema.describe("Absolute path to the remote file. Must start with /."),
       content: z.string().describe("File content to write")
     },
     async ({ path, content, ...conn }) => {
@@ -1469,7 +1481,7 @@ ${result.stderr}`);
     {
       ...connectionParams,
       localPath: z.string().describe("Path to the local file to upload"),
-      remotePath: z.string().describe("Absolute path on the remote host")
+      remotePath: AbsoluteRemotePathSchema.describe("Absolute path on the remote host. Must start with /.")
     },
     async ({ localPath, remotePath, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1483,7 +1495,7 @@ ${result.stderr}`);
     "Download a file from a remote host to local filesystem via SFTP.",
     {
       ...connectionParams,
-      remotePath: z.string().describe("Absolute path to the remote file"),
+      remotePath: AbsoluteRemotePathSchema.describe("Absolute path to the remote file. Must start with /."),
       localPath: z.string().describe("Local path to save the downloaded file")
     },
     async ({ remotePath, localPath, ...conn }) => {
@@ -1498,7 +1510,7 @@ ${result.stderr}`);
     "List files in a directory on a remote host via SFTP.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path to the remote directory")
+      path: AbsoluteRemotePathSchema.describe("Absolute path to the remote directory. Must start with /.")
     },
     async ({ path, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1512,7 +1524,7 @@ ${result.stderr}`);
     "Get metadata for a file or directory on a remote host via SFTP. Returns size, permissions (octal), uid/gid, mtime/atime, and type flags (isFile, isDirectory, isSymbolicLink). Use this instead of parsing `ls -la` output.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path to the remote file or directory")
+      path: AbsoluteRemotePathSchema.describe("Absolute path to the remote file or directory. Must start with /.")
     },
     async ({ path, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1549,7 +1561,9 @@ ${result.stderr}`);
     "Delete a file or empty directory on a remote host via SFTP. Auto-detects the path type and calls the right SFTP op (unlink for files/symlinks, rmdir for empty dirs). Recursive directory delete is intentionally NOT supported -- for that, use ssh_exec with `rm -rf` explicitly so the destructive intent is visible in the tool trace.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path of the file or empty directory to delete")
+      path: AbsoluteRemotePathSchema.describe(
+        "Absolute path of the file or empty directory to delete. Must start with /."
+      )
     },
     async ({ path, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1824,8 +1838,7 @@ ${files.join("\n")}` }] };
 }
 
 // src/server.ts
-var pkgPath = join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
-var { version } = JSON.parse(readFileSync4(pkgPath, "utf8"));
+var version = typeof __VERSION__ !== "undefined" ? __VERSION__ : JSON.parse(readFileSync4(join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8")).version;
 function createServer(pool) {
   const server = new McpServer({
     name: "ssh-mcp",
@@ -1836,6 +1849,10 @@ function createServer(pool) {
 }
 
 // src/index.ts
+if (process.argv[2] === "--version" || process.argv[2] === "version") {
+  console.log(version);
+  process.exit(0);
+}
 async function main() {
   const pool = new ConnectionPool();
   const server = createServer(pool);

package/dist/server.d.ts

@@ -217,6 +217,7 @@ declare function isPolicyConfigured(): boolean;
 
 declare function registerTools(server: McpServer, pool?: ConnectionPool): void;
 
+declare const version: string;
 declare function createServer(pool?: ConnectionPool): McpServer;
 
-export { type AgentResult, type ConfigLookupResult, ConnectionPool, type DiagnosticReport, type DiagnosticResult, type ExecResult, type FileStats, type FindOptions, type KeyInfo, type MultiExecHost, type MultiExecResult, type PoolOptions, type ResolvedConfig, type SSHConfig, type ServiceStatus, checkConnectivity, checkGitSsh, checkKnownHosts, checkSshAgent, checkSshConfig, checkSshKeys, configLookup, connect, connectRaw, connectWithProxy, createServer, deleteFile, diagnose, downloadFile, enforcePolicy, ensureAgent, exec, find, fixKnownHosts, formatDiagnostics, isPolicyConfigured, listDir, listSshKeys, loadKey, makeDir, multiExec, readFile, readKnownHostsKeys, registerTools, resolveConfig, serviceStatus, statFile, tail, testConnection, uploadFile, writeFile };
+export { type AgentResult, type ConfigLookupResult, ConnectionPool, type DiagnosticReport, type DiagnosticResult, type ExecResult, type FileStats, type FindOptions, type KeyInfo, type MultiExecHost, type MultiExecResult, type PoolOptions, type ResolvedConfig, type SSHConfig, type ServiceStatus, checkConnectivity, checkGitSsh, checkKnownHosts, checkSshAgent, checkSshConfig, checkSshKeys, configLookup, connect, connectRaw, connectWithProxy, createServer, deleteFile, diagnose, downloadFile, enforcePolicy, ensureAgent, exec, find, fixKnownHosts, formatDiagnostics, isPolicyConfigured, listDir, listSshKeys, loadKey, makeDir, multiExec, readFile, readKnownHostsKeys, registerTools, resolveConfig, serviceStatus, statFile, tail, testConnection, uploadFile, version, writeFile };

package/dist/server.js

@@ -212,8 +212,6 @@ function checkSshConfig(host) {
         if (inHostBlock) hostConfig.push(trimmed);
       } else if (inHostBlock && trimmed) {
         hostConfig.push(trimmed);
-      } else if (inHostBlock && !trimmed) {
-        inHostBlock = false;
       }
     }
     if (hostConfig.length === 0) {
@@ -608,7 +606,15 @@ import { readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 import { Client } from "ssh2";
+var sshConfigCache = /* @__PURE__ */ new Map();
 function resolveFromSshConfig(host) {
+  const cached = sshConfigCache.get(host);
+  if (cached !== void 0) return cached;
+  const result = resolveFromSshConfigUncached(host);
+  sshConfigCache.set(host, result);
+  return result;
+}
+function resolveFromSshConfigUncached(host) {
   try {
     const { stdout, ok } = runArgs("ssh", ["-G", host]);
     if (!ok) return null;
@@ -688,8 +694,10 @@ function resolveConfig(config) {
     keepaliveCountMax: 3,
     hostVerifier: buildHostVerifier(verifierHosts, port)
   };
+  const home = homedir3();
   if (config.privateKeyPath) {
-    connectConfig.privateKey = readFileSync3(config.privateKeyPath);
+    const keyPath = config.privateKeyPath.startsWith("~") ? join3(home, config.privateKeyPath.slice(1)) : config.privateKeyPath;
+    connectConfig.privateKey = readFileSync3(keyPath);
   } else if (config.password) {
     connectConfig.password = config.password;
   } else {
@@ -697,7 +705,6 @@ function resolveConfig(config) {
     if (agentSock) {
       connectConfig.agent = agentSock;
     }
-    const home = homedir3();
     const keyPaths = sshConfig && sshConfig.identityFiles.length > 0 ? sshConfig.identityFiles.map((p) => p.startsWith("~") ? join3(home, p.slice(1)) : p) : [join3(home, ".ssh", "id_ed25519"), join3(home, ".ssh", "id_rsa"), join3(home, ".ssh", "id_ecdsa")];
     for (const keyPath of keyPaths) {
       try {
@@ -952,10 +959,11 @@ async function writeFile(client, remotePath, content) {
   }
 }
 async function uploadFile(client, localPath, remotePath) {
+  const resolvedLocal = localPath.startsWith("~") ? join3(homedir3(), localPath.slice(1)) : localPath;
   const sftp = await getSftp(client);
   try {
     await new Promise((resolve, reject) => {
-      sftp.fastPut(localPath, remotePath, (err) => {
+      sftp.fastPut(resolvedLocal, remotePath, (err) => {
         if (err) return reject(err);
         resolve();
       });
@@ -965,10 +973,11 @@ async function uploadFile(client, localPath, remotePath) {
   }
 }
 async function downloadFile(client, remotePath, localPath) {
+  const resolvedLocal = localPath.startsWith("~") ? join3(homedir3(), localPath.slice(1)) : localPath;
   const sftp = await getSftp(client);
   try {
     await new Promise((resolve, reject) => {
-      sftp.fastGet(remotePath, localPath, (err) => {
+      sftp.fastGet(remotePath, resolvedLocal, (err) => {
         if (err) return reject(err);
         resolve();
       });
@@ -1088,16 +1097,16 @@ async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
     };
   });
 }
-var VALID_FIND_SIZE = /^\d+[kMGTP]?$/;
+var VALID_FIND_SIZE = /^\d+[cwbkMG]?$/;
 async function find(client, options, timeoutMs = 3e4) {
   if (options.minsize && !VALID_FIND_SIZE.test(options.minsize)) {
     throw new Error(
-      `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional k/M/G/T/P (e.g. "1M", "100k")`
+      `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "1M", "100k")`
     );
   }
   if (options.maxsize && !VALID_FIND_SIZE.test(options.maxsize)) {
     throw new Error(
-      `Invalid maxsize format: "${options.maxsize}". Expected: digits followed by optional k/M/G/T/P (e.g. "10M", "500k")`
+      `Invalid maxsize format: "${options.maxsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "10M", "500k")`
     );
   }
   const args = ["--", shellQuote(options.path)];
@@ -1392,6 +1401,9 @@ ${diag}`);
 
 // src/tools.ts
 var HostSchema = z.string().describe("SSH hostname or IP address");
+var AbsoluteRemotePathSchema = z.string().refine((p) => p.startsWith("/"), {
+  message: "Path must be absolute (start with /). SFTP does not expand ~ or resolve relative paths through a shell."
+});
 var PortSchema = z.number().int().min(1).max(65535).optional().describe("SSH port (default: 22)");
 var UsernameSchema = z.string().optional().describe("SSH username (default: current user)");
 var KeyPathSchema = z.string().optional().describe("Path to SSH private key");
@@ -1459,7 +1471,7 @@ ${result.stderr}`);
     "Write content to a file on a remote host via SFTP. Creates or overwrites the file.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path to the remote file"),
+      path: AbsoluteRemotePathSchema.describe("Absolute path to the remote file. Must start with /."),
       content: z.string().describe("File content to write")
     },
     async ({ path, content, ...conn }) => {
@@ -1475,7 +1487,7 @@ ${result.stderr}`);
     {
       ...connectionParams,
       localPath: z.string().describe("Path to the local file to upload"),
-      remotePath: z.string().describe("Absolute path on the remote host")
+      remotePath: AbsoluteRemotePathSchema.describe("Absolute path on the remote host. Must start with /.")
     },
     async ({ localPath, remotePath, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1489,7 +1501,7 @@ ${result.stderr}`);
     "Download a file from a remote host to local filesystem via SFTP.",
     {
       ...connectionParams,
-      remotePath: z.string().describe("Absolute path to the remote file"),
+      remotePath: AbsoluteRemotePathSchema.describe("Absolute path to the remote file. Must start with /."),
       localPath: z.string().describe("Local path to save the downloaded file")
     },
     async ({ remotePath, localPath, ...conn }) => {
@@ -1504,7 +1516,7 @@ ${result.stderr}`);
     "List files in a directory on a remote host via SFTP.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path to the remote directory")
+      path: AbsoluteRemotePathSchema.describe("Absolute path to the remote directory. Must start with /.")
     },
     async ({ path, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1518,7 +1530,7 @@ ${result.stderr}`);
     "Get metadata for a file or directory on a remote host via SFTP. Returns size, permissions (octal), uid/gid, mtime/atime, and type flags (isFile, isDirectory, isSymbolicLink). Use this instead of parsing `ls -la` output.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path to the remote file or directory")
+      path: AbsoluteRemotePathSchema.describe("Absolute path to the remote file or directory. Must start with /.")
     },
     async ({ path, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1555,7 +1567,9 @@ ${result.stderr}`);
     "Delete a file or empty directory on a remote host via SFTP. Auto-detects the path type and calls the right SFTP op (unlink for files/symlinks, rmdir for empty dirs). Recursive directory delete is intentionally NOT supported -- for that, use ssh_exec with `rm -rf` explicitly so the destructive intent is visible in the tool trace.",
     {
       ...connectionParams,
-      path: z.string().describe("Absolute path of the file or empty directory to delete")
+      path: AbsoluteRemotePathSchema.describe(
+        "Absolute path of the file or empty directory to delete. Must start with /."
+      )
     },
     async ({ path, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
@@ -1830,8 +1844,7 @@ ${files.join("\n")}` }] };
 }
 
 // src/server.ts
-var pkgPath = join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
-var { version } = JSON.parse(readFileSync4(pkgPath, "utf8"));
+var version = typeof __VERSION__ !== "undefined" ? __VERSION__ : JSON.parse(readFileSync4(join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8")).version;
 function createServer(pool) {
   const server = new McpServer({
     name: "ssh-mcp",
@@ -1877,5 +1890,6 @@ export {
   tail,
   testConnection,
   uploadFile,
+  version,
   writeFile
 };

package/package.json

@@ -1,62 +1,67 @@
-{
-  "name": "@yawlabs/ssh-mcp",
-  "version": "0.11.5",
-  "mcpName": "io.github.YawLabs/ssh-mcp",
-  "description": "MCP server for SSH operations with built-in diagnostics",
-  "type": "module",
-  "bin": {
-    "ssh-mcp": "dist/index.js"
-  },
-  "exports": {
-    ".": {
-      "import": "./dist/server.js",
-      "types": "./dist/server.d.ts"
-    }
-  },
-  "files": [
-    "dist",
-    "LICENSE",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "lint": "biome check src/",
-    "lint:fix": "biome check --write src/",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:integration": "docker compose -f test/docker/docker-compose.yml up -d --build --wait && SSH_MCP_INTEGRATION=1 vitest run src/tests/integration.test.ts; docker compose -f test/docker/docker-compose.yml down",
-    "test:ci": "npm run build && npm test",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "mcp",
-    "ssh",
-    "remote",
-    "model-context-protocol",
-    "ai",
-    "devops"
-  ],
-  "author": "Yaw Labs <contact@yaw.sh>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/YawLabs/ssh-mcp.git"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "ssh2": "^1.17.0",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^2.4.15",
-    "@types/node": "^25.7.0",
-    "@types/ssh2": "^1.15.5",
-    "tsup": "^8.5.1",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
-  }
-}
+{
+  "name": "@yawlabs/ssh-mcp",
+  "version": "0.12.0",
+  "mcpName": "io.github.YawLabs/ssh-mcp",
+  "description": "MCP server for SSH operations with built-in diagnostics",
+  "type": "module",
+  "bin": {
+    "ssh-mcp": "dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/server.js",
+      "types": "./dist/server.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "biome check src/",
+    "lint:fix": "biome check --write src/",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:integration": "docker compose -f test/docker/docker-compose.yml up -d --build --wait && SSH_MCP_INTEGRATION=1 vitest run src/tests/integration.test.ts; docker compose -f test/docker/docker-compose.yml down",
+    "test:ci": "npm run build && npm test",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "ssh",
+    "remote",
+    "model-context-protocol",
+    "ai",
+    "devops"
+  ],
+  "author": "Yaw Labs <contact@yaw.sh>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/YawLabs/ssh-mcp.git"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "ssh2": "^1.17.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.15",
+    "@types/node": "^26.1.1",
+    "@types/ssh2": "^1.15.5",
+    "esbuild": "^0.28.1",
+    "postject": "^1.0.0-alpha.6",
+    "tsup": "^8.5.1",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.6"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
+  }
+}