@yawlabs/ssh-mcp 0.9.1 → 0.9.3

package/dist/index.js

@@ -202,8 +202,9 @@ function checkSshConfig(host) {
         inHostBlock = patterns.some((p) => {
           if (p === "*") return true;
           if (p === host) return true;
-          if (p.includes("*")) {
-            const regex = new RegExp("^" + p.replace(/\./g, "\\.").replace(/\*/g, ".*") + "$");
+          if (p.includes("*") || p.includes("?")) {
+            const escaped = p.replace(/[\\^$.|+()[\]{}]/g, "\\$&");
+            const regex = new RegExp("^" + escaped.replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
             return regex.test(host);
           }
           return false;
@@ -339,9 +340,16 @@ function ensureAgent() {
     const result = probeAgent(sock, "ssh-agent");
     if (result) return result;
   }
-  if (!sock && process.platform === "win32") {
+  if (process.platform === "win32") {
     const result = probeAgent("\\\\.\\pipe\\openssh-ssh-agent", "Windows OpenSSH agent");
     if (result) return result;
+    return {
+      running: false,
+      reachable: false,
+      keys: [],
+      started: false,
+      message: "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent"
+    };
   }
   const { stdout, ok } = runArgs("ssh-agent", ["-s"]);
   if (ok) {
@@ -369,7 +377,7 @@ function ensureAgent() {
     reachable: false,
     keys: [],
     started: false,
-    message: process.platform === "win32" ? "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent" : 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
+    message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
 function detectKeyType(filePath, fileName) {
@@ -458,10 +466,10 @@ function loadKey(keyPath) {
   if (ok) {
     return { status: "ok", message: `Key loaded: ${resolved}` };
   }
-  if (stdout.includes("passphrase") || stdout.includes("incorrect") || stdout.includes("bad permissions")) {
-    if (stdout.includes("UNPROTECTED PRIVATE KEY")) {
-      return { status: "error", message: `Key ${resolved} has too-open permissions. Fix: chmod 600 ${resolved}` };
-    }
+  if (stdout.includes("UNPROTECTED PRIVATE KEY") || stdout.includes("too open") || stdout.includes("bad permissions")) {
+    return { status: "error", message: `Key ${resolved} has too-open permissions. Fix: chmod 600 ${resolved}` };
+  }
+  if (stdout.includes("passphrase") || stdout.includes("incorrect")) {
     return { status: "error", message: `Key ${resolved} requires a passphrase. Add it manually: ssh-add ${resolved}` };
   }
   return { status: "error", message: `Failed to load key: ${stdout}` };
@@ -749,10 +757,16 @@ async function connectWithProxy(resolved) {
   const jumpClient = await connectWithProxy(jumpResolved);
   const targetHost = resolved.connectConfig.host;
   const targetPort = resolved.connectConfig.port;
+  const endJump = () => {
+    try {
+      jumpClient.end();
+    } catch {
+    }
+  };
   const stream = await new Promise((resolve, reject) => {
     jumpClient.forwardOut("127.0.0.1", 0, targetHost, targetPort, (err, stream2) => {
       if (err) {
-        jumpClient.end();
+        endJump();
         return reject(err);
       }
       resolve(stream2);
@@ -761,10 +775,10 @@ async function connectWithProxy(resolved) {
   return new Promise((resolve, reject) => {
     const client = new Client();
     client.on("ready", () => resolve(client)).on("error", (err) => {
-      jumpClient.end();
+      endJump();
       reject(err);
     }).on("close", () => {
-      jumpClient.end();
+      endJump();
     }).connect({ ...resolved.connectConfig, sock: stream });
   });
 }
@@ -832,14 +846,19 @@ function exec(client, command, timeoutMs = 3e4, maxBytes = DEFAULT_MAX_EXEC_BYTE
           stderrTruncated = true;
         }
       };
-      stream.on("close", (code) => {
+      stream.on("close", (code, signal) => {
         let stdout = Buffer.concat(stdoutChunks).toString("utf8");
         let stderr = Buffer.concat(stderrChunks).toString("utf8");
         if (stdoutTruncated) stdout += `
 [output truncated at ${maxBytes} bytes]`;
         if (stderrTruncated) stderr += `
 [stderr truncated at ${maxBytes} bytes]`;
-        settle(() => resolve({ stdout, stderr, code: code ?? 0 }));
+        const exitCode = typeof code === "number" ? code : -1;
+        const result = { stdout, stderr, code: exitCode };
+        if (stdoutTruncated) result.stdoutTruncated = true;
+        if (stderrTruncated) result.stderrTruncated = true;
+        if (signal) result.signal = signal;
+        settle(() => resolve(result));
       }).on("data", appendStdout).on("error", (err2) => {
         settle(() => reject(err2));
       });
@@ -936,6 +955,12 @@ async function listDir(client, remotePath) {
 }
 
 // src/pool.ts
+function defaultMaxPoolSize() {
+  const raw = process.env.SSH_MCP_MAX_POOL_SIZE;
+  if (!raw) return 100;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
+}
 var ConnectionPool = class {
   entries = /* @__PURE__ */ new Map();
   // Coalesces concurrent connect attempts for the same key so we don't open N
@@ -952,7 +977,7 @@ var ConnectionPool = class {
   drained = false;
   constructor(options) {
     this.idleTtlMs = options?.idleTtlMs ?? 6e4;
-    this.maxPoolSize = options?.maxPoolSize ?? 100;
+    this.maxPoolSize = options?.maxPoolSize ?? defaultMaxPoolSize();
   }
   async acquire(config) {
     const resolved = resolveConfig(config);
@@ -1202,6 +1227,7 @@ async function serviceStatus(client, serviceName, timeoutMs = 3e4) {
   const descMatch = raw.match(/^\s+.*?-\s+(.+)$/m);
   const pidMatch = raw.match(/Main PID:\s+(\d+)/);
   const sinceMatch = raw.match(/since\s+(.+?);/);
+  const unknown = !activeMatch && result.code !== 0;
   const fallbackStatus = result.code === 0 ? "active" : "inactive";
   return {
     name: serviceName,
@@ -1210,7 +1236,8 @@ async function serviceStatus(client, serviceName, timeoutMs = 3e4) {
     description: descMatch?.[1]?.trim(),
     since: sinceMatch?.[1]?.trim(),
     pid: pidMatch ? Number.parseInt(pidMatch[1], 10) : void 0,
-    raw
+    raw,
+    unknown
   };
 }
 
@@ -1247,6 +1274,7 @@ function registerTools(server, pool) {
         if (result.stdout) parts.push(result.stdout);
         if (result.stderr) parts.push(`[stderr]
 ${result.stderr}`);
+        if (result.signal) parts.push(`[signal: ${result.signal}]`);
         parts.push(`[exit code: ${result.code}]`);
         return { content: [{ type: "text", text: parts.join("\n") }] };
       });
@@ -1523,11 +1551,12 @@ ${result.stderr}`);
       maxdepth: z.number().optional().describe("Maximum directory depth to search"),
       minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
       maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
+      newer: z.string().optional().describe("Reference file path -- find matches files modified more recently than this file"),
       timeout: TimeoutSchema
     },
-    async ({ path, name, type, maxdepth, minsize, maxsize, timeout, ...conn }) => {
+    async ({ path, name, type, maxdepth, minsize, maxsize, newer, timeout, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
-        const files = await find(client, { path, name, type, maxdepth, minsize, maxsize }, timeout || 3e4);
+        const files = await find(client, { path, name, type, maxdepth, minsize, maxsize, newer }, timeout || 3e4);
         if (files.length === 0) {
           return { content: [{ type: "text", text: "No files found." }] };
         }
@@ -1542,7 +1571,7 @@ ${files.join("\n")}` }] };
     {
       ...connectionParams,
       path: z.string().describe("Absolute path to the file to tail"),
-      lines: z.number().optional().describe("Number of lines to read from the end (default: 100)"),
+      lines: z.number().int().positive().optional().describe("Number of lines to read from the end (default: 100). Must be a positive integer."),
       grep: z.string().optional().describe("Case-insensitive pattern to filter lines"),
       timeout: TimeoutSchema
     },
@@ -1582,7 +1611,7 @@ ${files.join("\n")}` }] };
         if (status.since) lines.push(`Since: ${status.since}`);
         lines.push("");
         lines.push(status.raw);
-        return { content: [{ type: "text", text: lines.join("\n") }], isError: !status.active };
+        return { content: [{ type: "text", text: lines.join("\n") }], isError: status.unknown };
       });
     }
   );

package/dist/server.d.ts

@@ -13,6 +13,12 @@ interface ExecResult {
     stdout: string;
     stderr: string;
     code: number;
+    /** True when stdout was truncated at the byte cap. */
+    stdoutTruncated?: boolean;
+    /** True when stderr was truncated at the byte cap. */
+    stderrTruncated?: boolean;
+    /** Signal name (e.g. "TERM") if the remote channel closed via signal instead of exit. */
+    signal?: string;
 }
 interface ResolvedConfig {
     connectConfig: ConnectConfig;
@@ -34,7 +40,13 @@ declare function listDir(client: Client, remotePath: string): Promise<string[]>;
 interface PoolOptions {
     /** Milliseconds before an idle connection is closed. Default: 60000 (60s) */
     idleTtlMs?: number;
-    /** Maximum number of connections in the pool. Default: 100 */
+    /**
+     * Maximum number of connections in the pool. Default: 100, overridable via the
+     * `SSH_MCP_MAX_POOL_SIZE` env var. When at capacity, the pool first tries to evict
+     * an idle entry; if every entry is in use, `acquire()` rejects with
+     * "Connection pool is full". Bump this for fan-out workloads against many distinct
+     * hosts (e.g. `ssh_multi_exec` across a large fleet).
+     */
     maxPoolSize?: number;
 }
 declare class ConnectionPool {
@@ -163,6 +175,13 @@ interface ServiceStatus {
     since?: string;
     pid?: number;
     raw: string;
+    /**
+     * True when systemctl could not report on the unit at all: no `Active:` line
+     * parseable AND non-zero exit. Typical causes: typo'd unit name, unit file
+     * doesn't exist, systemd unreachable. Distinct from "service exists but is
+     * stopped" (active=false but unknown=false).
+     */
+    unknown: boolean;
 }
 declare function serviceStatus(client: Client, serviceName: string, timeoutMs?: number): Promise<ServiceStatus>;
 

package/dist/server.js

@@ -200,8 +200,9 @@ function checkSshConfig(host) {
         inHostBlock = patterns.some((p) => {
           if (p === "*") return true;
           if (p === host) return true;
-          if (p.includes("*")) {
-            const regex = new RegExp("^" + p.replace(/\./g, "\\.").replace(/\*/g, ".*") + "$");
+          if (p.includes("*") || p.includes("?")) {
+            const escaped = p.replace(/[\\^$.|+()[\]{}]/g, "\\$&");
+            const regex = new RegExp("^" + escaped.replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
             return regex.test(host);
           }
           return false;
@@ -335,9 +336,16 @@ function ensureAgent() {
     const result = probeAgent(sock, "ssh-agent");
     if (result) return result;
   }
-  if (!sock && process.platform === "win32") {
+  if (process.platform === "win32") {
     const result = probeAgent("\\\\.\\pipe\\openssh-ssh-agent", "Windows OpenSSH agent");
     if (result) return result;
+    return {
+      running: false,
+      reachable: false,
+      keys: [],
+      started: false,
+      message: "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent"
+    };
   }
   const { stdout, ok } = runArgs("ssh-agent", ["-s"]);
   if (ok) {
@@ -365,7 +373,7 @@ function ensureAgent() {
     reachable: false,
     keys: [],
     started: false,
-    message: process.platform === "win32" ? "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent" : 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
+    message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
 function detectKeyType(filePath, fileName) {
@@ -454,10 +462,10 @@ function loadKey(keyPath) {
   if (ok) {
     return { status: "ok", message: `Key loaded: ${resolved}` };
   }
-  if (stdout.includes("passphrase") || stdout.includes("incorrect") || stdout.includes("bad permissions")) {
-    if (stdout.includes("UNPROTECTED PRIVATE KEY")) {
-      return { status: "error", message: `Key ${resolved} has too-open permissions. Fix: chmod 600 ${resolved}` };
-    }
+  if (stdout.includes("UNPROTECTED PRIVATE KEY") || stdout.includes("too open") || stdout.includes("bad permissions")) {
+    return { status: "error", message: `Key ${resolved} has too-open permissions. Fix: chmod 600 ${resolved}` };
+  }
+  if (stdout.includes("passphrase") || stdout.includes("incorrect")) {
     return { status: "error", message: `Key ${resolved} requires a passphrase. Add it manually: ssh-add ${resolved}` };
   }
   return { status: "error", message: `Failed to load key: ${stdout}` };
@@ -745,10 +753,16 @@ async function connectWithProxy(resolved) {
   const jumpClient = await connectWithProxy(jumpResolved);
   const targetHost = resolved.connectConfig.host;
   const targetPort = resolved.connectConfig.port;
+  const endJump = () => {
+    try {
+      jumpClient.end();
+    } catch {
+    }
+  };
   const stream = await new Promise((resolve, reject) => {
     jumpClient.forwardOut("127.0.0.1", 0, targetHost, targetPort, (err, stream2) => {
       if (err) {
-        jumpClient.end();
+        endJump();
         return reject(err);
       }
       resolve(stream2);
@@ -757,10 +771,10 @@ async function connectWithProxy(resolved) {
   return new Promise((resolve, reject) => {
     const client = new Client();
     client.on("ready", () => resolve(client)).on("error", (err) => {
-      jumpClient.end();
+      endJump();
       reject(err);
     }).on("close", () => {
-      jumpClient.end();
+      endJump();
     }).connect({ ...resolved.connectConfig, sock: stream });
   });
 }
@@ -846,14 +860,19 @@ function exec(client, command, timeoutMs = 3e4, maxBytes = DEFAULT_MAX_EXEC_BYTE
           stderrTruncated = true;
         }
       };
-      stream.on("close", (code) => {
+      stream.on("close", (code, signal) => {
         let stdout = Buffer.concat(stdoutChunks).toString("utf8");
         let stderr = Buffer.concat(stderrChunks).toString("utf8");
         if (stdoutTruncated) stdout += `
 [output truncated at ${maxBytes} bytes]`;
         if (stderrTruncated) stderr += `
 [stderr truncated at ${maxBytes} bytes]`;
-        settle(() => resolve({ stdout, stderr, code: code ?? 0 }));
+        const exitCode = typeof code === "number" ? code : -1;
+        const result = { stdout, stderr, code: exitCode };
+        if (stdoutTruncated) result.stdoutTruncated = true;
+        if (stderrTruncated) result.stderrTruncated = true;
+        if (signal) result.signal = signal;
+        settle(() => resolve(result));
       }).on("data", appendStdout).on("error", (err2) => {
         settle(() => reject(err2));
       });
@@ -1019,6 +1038,7 @@ async function serviceStatus(client, serviceName, timeoutMs = 3e4) {
   const descMatch = raw.match(/^\s+.*?-\s+(.+)$/m);
   const pidMatch = raw.match(/Main PID:\s+(\d+)/);
   const sinceMatch = raw.match(/since\s+(.+?);/);
+  const unknown = !activeMatch && result.code !== 0;
   const fallbackStatus = result.code === 0 ? "active" : "inactive";
   return {
     name: serviceName,
@@ -1027,11 +1047,18 @@ async function serviceStatus(client, serviceName, timeoutMs = 3e4) {
     description: descMatch?.[1]?.trim(),
     since: sinceMatch?.[1]?.trim(),
     pid: pidMatch ? Number.parseInt(pidMatch[1], 10) : void 0,
-    raw
+    raw,
+    unknown
   };
 }
 
 // src/pool.ts
+function defaultMaxPoolSize() {
+  const raw = process.env.SSH_MCP_MAX_POOL_SIZE;
+  if (!raw) return 100;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
+}
 var ConnectionPool = class {
   entries = /* @__PURE__ */ new Map();
   // Coalesces concurrent connect attempts for the same key so we don't open N
@@ -1048,7 +1075,7 @@ var ConnectionPool = class {
   drained = false;
   constructor(options) {
     this.idleTtlMs = options?.idleTtlMs ?? 6e4;
-    this.maxPoolSize = options?.maxPoolSize ?? 100;
+    this.maxPoolSize = options?.maxPoolSize ?? defaultMaxPoolSize();
   }
   async acquire(config) {
     const resolved = resolveConfig(config);
@@ -1252,6 +1279,7 @@ function registerTools(server, pool) {
         if (result.stdout) parts.push(result.stdout);
         if (result.stderr) parts.push(`[stderr]
 ${result.stderr}`);
+        if (result.signal) parts.push(`[signal: ${result.signal}]`);
         parts.push(`[exit code: ${result.code}]`);
         return { content: [{ type: "text", text: parts.join("\n") }] };
       });
@@ -1528,11 +1556,12 @@ ${result.stderr}`);
       maxdepth: z.number().optional().describe("Maximum directory depth to search"),
       minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
       maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
+      newer: z.string().optional().describe("Reference file path -- find matches files modified more recently than this file"),
       timeout: TimeoutSchema
     },
-    async ({ path, name, type, maxdepth, minsize, maxsize, timeout, ...conn }) => {
+    async ({ path, name, type, maxdepth, minsize, maxsize, newer, timeout, ...conn }) => {
       return connectionPool.withConnection(conn, async (client) => {
-        const files = await find(client, { path, name, type, maxdepth, minsize, maxsize }, timeout || 3e4);
+        const files = await find(client, { path, name, type, maxdepth, minsize, maxsize, newer }, timeout || 3e4);
         if (files.length === 0) {
           return { content: [{ type: "text", text: "No files found." }] };
         }
@@ -1547,7 +1576,7 @@ ${files.join("\n")}` }] };
     {
       ...connectionParams,
       path: z.string().describe("Absolute path to the file to tail"),
-      lines: z.number().optional().describe("Number of lines to read from the end (default: 100)"),
+      lines: z.number().int().positive().optional().describe("Number of lines to read from the end (default: 100). Must be a positive integer."),
       grep: z.string().optional().describe("Case-insensitive pattern to filter lines"),
       timeout: TimeoutSchema
     },
@@ -1587,7 +1616,7 @@ ${files.join("\n")}` }] };
         if (status.since) lines.push(`Since: ${status.since}`);
         lines.push("");
         lines.push(status.raw);
-        return { content: [{ type: "text", text: lines.join("\n") }], isError: !status.active };
+        return { content: [{ type: "text", text: lines.join("\n") }], isError: status.unknown };
       });
     }
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ssh-mcp",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "MCP server for SSH operations with built-in diagnostics",
   "type": "module",
   "bin": {
@@ -47,15 +47,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "ssh2": "^1.16.0",
-    "zod": "^4.3.6"
+    "ssh2": "^1.17.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.13",
-    "@types/node": "^25.6.0",
-    "@types/ssh2": "^1.15.4",
+    "@biomejs/biome": "^2.4.15",
+    "@types/node": "^25.7.0",
+    "@types/ssh2": "^1.15.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.6"
   }
 }