@yottameta/yotta-dev-mcp 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v0.2.5 (2026-10-31)
+
+安全热修批次（ClawHub 0.2.4 扫描复核）：
+
+- `review_diff`：`base` 先解析为 commit SHA（`git rev-parse --verify --end-of-options`），
+  拒绝以 `-` 开头、含空白、超长或无法解析的 revision；防止 `--output=` 等 Git 选项注入
+  在仓库外写文件。
+- `workflow_state`：原子写入改为同目录随机独占临时文件 + `os.replace`；备份同样先写
+  随机临时文件；拒绝目标 / 祖先路径中的 symlink、junction 等 reparse point；预置
+  `.tmp` / `.bak` 链接不会再重定向写入。
+- 回归：新增 option injection、valid base、temp / backup / hardlink / junction 用例；
+  全量测试 **199（3 skip）**。
+
 ## v0.2.4 (2026-10-31)
 
 外部缺陷报告修复批次：

package/README.md

@@ -18,14 +18,14 @@ Deterministic local development tools exposed over a stdio MCP server.
 | `find_code` | Locate symbols and text with bounded results. |
 | `compress_output` | Compress long logs while keeping errors and head/tail context. |
 | `review_code` | Apply deterministic review rules with file, line and evidence. |
-| `review_diff` | Review only added lines in a unified diff. |
+| `review_diff` | Review only added lines in a unified diff; `base` resolves to a commit SHA. |
 | `mcp_doctor` | Inspect installed skills and MCP JSON configuration files. |
 | `scan_secrets` | Scan for credentials and high-entropy tokens with redacted evidence. |
 | `scan_dependencies` | Check manifests, lockfiles, insecure sources and typosquat suspicion. |
 | `check_publish_readiness` | Check version alignment, release files and package metadata. |
 | `run_checks` | Run whitelisted tests, lint or compile checks; execution is explicit. |
 | `scaffold_skill` | Plan or create a minimal skill scaffold; dry-run by default. |
-| `workflow_state` | Read `.workflow` and optionally append an explicit log entry. |
+| `workflow_state` | Read `.workflow` and optionally append an explicit log entry; writes are atomic and reject link paths. |
 
 Tools are read-only by default; `run_checks`, the L2-L4 policy checks in
 `verify_change`, the test subset in `self_test`, and `run_adapter` with

package/README.zh-CN.md

@@ -18,14 +18,14 @@
 | `find_code` | 符号与文本定位，结果有数量上限。 |
 | `compress_output` | 压缩长日志，保留错误、错误栈和首尾上下文。 |
 | `review_code` | 规则化代码评审，输出文件、行号、证据与建议。 |
-| `review_diff` | 只评审 unified diff 的新增行。 |
+| `review_diff` | 只评审 unified diff 的新增行；`base` 先解析为 commit SHA。 |
 | `mcp_doctor` | 只读检查技能目录与 MCP JSON 配置。 |
 | `scan_secrets` | 密钥 / 凭据 / 高熵令牌扫描，证据强制脱敏。 |
 | `scan_dependencies` | 依赖清单、lockfile、来源与 typosquat 启发式检查。 |
 | `check_publish_readiness` | 版本对齐、发布文件与包元数据检查。 |
 | `run_checks` | 运行白名单测试 / lint / compile，执行必须显式开启。 |
 | `scaffold_skill` | 规划或生成最小技能脚手架，默认 dry-run。 |
-| `workflow_state` | 读取 `.workflow`，可选显式追加快照日志。 |
+| `workflow_state` | 读取 `.workflow`，可选显式追加快照日志；写入原子化并拒绝链接路径。 |
 
 默认只读；`run_checks`、`verify_change` 的 L2-L4 策略检查、`self_test` 的测试子集，
 以及 `run_adapter` 的 `action=run` 必须显式 `allow_execute=true`，

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: yotta-dev-mcp
 description: 元开（yotta-dev-mcp）—— 本地、确定性的开发工具 MCP，把只读默认的开发能力暴露为 stdio MCP server：repo_map / system_model / architecture_review / impact_analysis / verify_change / self_test / run_adapter / find_code / compress_output / review_code / review_diff / mcp_doctor / scan_secrets / scan_dependencies / check_publish_readiness / run_checks / scaffold_skill / workflow_state。触发：让 AI 在陌生项目里先做结构盘点、构建系统模型或架构契约（.yotta/architecture.json）、按契约评审架构、分析改动影响锥与回归面、按验证阶梯产出证据账本、对元开自身做完整性 / 反证自测、探测或显式运行 import-linter / dependency-cruiser / Repomix 可选适配器、定位代码、评审改动、扫描密钥/依赖、检查发布就绪、运行白名单检查、生成脚手架或读取 .workflow 状态时；或用户说 元开 / 开发能力 MCP / yotta-dev-mcp / 代码库地图 / 系统模型 / 架构契约 / 架构评审 / 影响分析 / 验证账本 / 反证自测 / 代码评审 MCP / 适配器 等。边界：Python 3.8+ 标准库、离线默认；除 run_checks（显式 allow_execute）、verify_change 的 L2-L4 策略检查（显式 allow_execute）与 self_test 的测试子集（显式 allow_execute）、run_adapter 的 action=run（显式 allow_execute）、scaffold_skill / workflow_state 的显式 apply 外均为只读；不上传源码、不自动修改、不提交、不联网查询包是否存在、不自动安装或下载适配器。
-version: 0.2.4
+version: 0.2.5
 license: MIT
 ---
 
@@ -72,14 +72,14 @@ python scripts/yotta_dev_mcp.py --tools full   # 18 工具（默认）
 | `find_code` | 符号 / 文本定位，结果有上限 | 否 |
 | `compress_output` | 保留错误与首尾的长输出压缩 | 否 |
 | `review_code` | 规则化代码评审，带行号与建议；忽略 `.workflow` / `scratch` / `_probe` 等临时目录 | 否 |
-| `review_diff` | 只评审 diff 的新增行 | 否 |
+| `review_diff` | 只评审 diff 的新增行；`base` 先解析为 commit SHA，拒绝选项注入 | 否 |
 | `mcp_doctor` | 技能版本与多宿主 MCP 配置体检；返回 coverage，只列 server 名，不含 command / env | 否 |
 | `scan_secrets` | 密钥 / 凭据 / 高熵令牌扫描（强制脱敏；路径 / 哈希 / 文件名噪声过滤） | 否 |
 | `scan_dependencies` | 依赖清单、lockfile、来源与 typosquat 启发式检查 | 否 |
 | `check_publish_readiness` | 版本四件、发布文件、仓库与 publishConfig 检查 | 否 |
 | `run_checks` | 白名单测试 / lint / compile 并返回结构化摘要 | 仅显式 allow_execute |
 | `scaffold_skill` | 生成最小技能脚手架，默认 dry-run | 仅显式 apply |
-| `workflow_state` | 读取 `.workflow`，可选显式追加日志 | 仅显式 apply |
+| `workflow_state` | 读取 `.workflow`，可选显式追加日志；写入拒绝链接路径并使用原子替换 | 仅显式 apply |
 
 详细契约见 `references/tools.md`；架构契约、评审语义与影响锥字段见 `references/architecture-contract.md`。
 
@@ -88,13 +88,18 @@ python scripts/yotta_dev_mcp.py --tools full   # 18 工具（默认）
 - 会执行项目代码的工具默认关闭：`run_checks`、`verify_change` 的 L2-L4 策略检查、`self_test` 的测试子集都必须显式 `allow_execute=true`，且只运行白名单检查或已声明的策略检查。
 - 外部适配器只在用户已安装时接入：`run_adapter` 不安装、不下载、不访问远端、不接收任意命令参数；工具缺失或配置缺失一律返回 `UNKNOWN` 并给出 next_step。
 - `scaffold_skill` / `workflow_state` 默认只预览，显式 `apply=true` 才写入；脚手架拒绝覆盖已有非空目录，状态写入使用原子替换并为被覆盖文件保留 `.bak`。
+- `workflow_state` 写入会拒绝目标或祖先路径中的 symlink / junction 等链接重定向；
+  临时文件使用随机独占名，避免可预测 `.tmp` / `.bak` 路径被预置链接利用。
 - `review_code` / `review_diff` 支持 `.review-allowlist.json`（或 `.yotta/review-allowlist.json`）精确豁免（path + rule + line + reason，无通配符）；非法配置 fail-closed，不抑制 findings。
+- `review_diff` 的 `base` 必须是可解析 Git revision；以 `-` 开头、含空白或无法解析的值会被拒绝，
+  防止 `--output=` 等选项注入。
 - 不联网，不查询包是否存在于公共仓库。
 - 不读取或修改 YottaCode 仓库。
 - 结论是确定性静态判断，不替代人工评审与最终决策。
 
 ## 当前版本
 
+- v0.2.5（2026-10-31）：安全热修——`review_diff` 的 `base` 先解析为 commit SHA，拒绝 Git 选项注入；`workflow_state` 改为随机独占临时文件 + 原子替换，备份同样原子化，并拒绝 symlink / junction 等链接路径；新增 option injection、temp / backup / hardlink / junction 回归。
 - v0.2.4（2026-10-31）：外部缺陷报告修复——`architecture_review` 修 BOM 假 PASS 与零证据 PASS；legacy `initialize` 报告当前工具档位；`review_code` / `review_diff` 修 `.exec(` 与字符串内待办标记误报并新增精确 allowlist；补齐临时 / 备份目录忽略；`scan_secrets` 补弱口令并去重；`find_code` 支持 `def ` 前缀；`self_test` 增加当前版本正文检查。
 - v0.2.3（2026-10-01）：安装器卫生批次——`bin/install.js` / `install.sh` 统一，未知参数 exit 2、`--help` / `--version`、残留清理白名单与嵌套载荷保留。
 - v0.2.2（2026-09-26）：新增 `--tools core|full` 工具分组；core 5 工具 / full 18 工具，core 拒绝 full 专属工具。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-dev-mcp",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "YuanKai (yotta-dev-mcp) - deterministic local development tools exposed over stdio MCP: repo_map, system_model, architecture_review, impact_analysis, verify_change, self_test, run_adapter, find_code, compress_output, review_code, review_diff, mcp_doctor, scan_secrets, scan_dependencies, check_publish_readiness, run_checks, scaffold_skill and workflow_state. Reads an optional .yotta/architecture.json contract plus .yotta/verification.json policy for architecture reviews, change impact cones and the L0-L5 evidence ledger. Optional explicit adapters integrate import-linter, dependency-cruiser and Repomix without auto-install or network access. Python 3.8+ standard library, offline by default; writes and command execution require explicit flags.",
   "license": "MIT",
   "keywords": [

package/references/tools.md

@@ -203,7 +203,9 @@ Each finding contains `path`, `line`, `rule`, `severity`, `evidence`, `suggestio
 Input:
 
 - `diff_text` or `path` (one required).
-- `base` (optional git revision when `path` is used).
+- `base` (optional git revision when `path` is used). It is resolved to a commit SHA
+  before `git diff` runs; option-like, whitespace-containing, oversized or
+  unresolvable revisions are rejected.
 - `max_findings` (optional).
 
 Only added lines are reviewed. Output: `files`, `findings`, `truncated`.
@@ -305,4 +307,6 @@ Input: `root`, `action` (`read` / `append-log` / `append-file`), optional
 `date`, `text`, `file`, explicit `apply=true`.
 
 Output: `ok`, `files`, `missing`, `excerpts` for read; `target`, `applied`,
-`preview` for writes. Writes are atomic and keep a `.bak` of an existing file.
+`preview` for writes. Writes use a random exclusive temporary file plus
+`os.replace`, keep a `.bak` of an existing file, and reject target or ancestor
+paths that are symlinks, junctions or other reparse points.

package/scripts/dev_engine.py

@@ -13,8 +13,10 @@ import math
 import os
 import re
 import shutil
+import stat
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 import dev_contract
@@ -41,7 +43,7 @@ from dev_model import (
 )
 from dev_rules import REVIEW_RULES
 
-VERSION = "0.2.4"
+VERSION = "0.2.5"
 
 
 
@@ -398,6 +400,28 @@ def _parse_added_lines(diff_text):
             line_no += 1
 
 
+def _resolve_git_commit(path, revision):
+    value = str(revision or "").strip()
+    if (
+        not value
+        or len(value) > 200
+        or value.startswith("-")
+        or any(char.isspace() for char in value)
+    ):
+        raise ValueError("base 不是有效 revision")
+    command = [
+        "git", "-C", str(path), "rev-parse", "--verify", "--quiet",
+        "--end-of-options", value + "^{commit}",
+    ]
+    proc = subprocess.run(command, capture_output=True, text=True)
+    if proc.returncode != 0:
+        raise ValueError("base revision 无法解析: %s" % value)
+    commit = proc.stdout.strip()
+    if not re.match(r"^[0-9a-fA-F]{40,64}$", commit):
+        raise ValueError("base revision 解析结果非法")
+    return commit
+
+
 def review_diff(diff_text=None, path=None, base=None, max_findings=200):
     allowlist = {}
     allowlist_errors = []
@@ -407,7 +431,7 @@ def review_diff(diff_text=None, path=None, base=None, max_findings=200):
         allowlist, allowlist_errors = _load_review_allowlist(path)
         command = ["git", "-C", str(path), "diff", "--no-ext-diff", "--unified=0"]
         if base:
-            command.append(str(base))
+            command.append(_resolve_git_commit(path, base))
         proc = subprocess.run(command, capture_output=True, text=True)
         if proc.returncode != 0:
             raise ValueError("git diff 失败: %s" % (proc.stderr.strip() or proc.stdout.strip()))
@@ -917,15 +941,80 @@ def scaffold_skill(name, output_dir, apply=False, description=None):
     }
 
 
+def _write_temp_text(path, content):
+    descriptor, name = tempfile.mkstemp(
+        prefix="." + path.name + ".", suffix=".tmp", dir=str(path.parent),
+    )
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            handle.write(content)
+    except BaseException:
+        try:
+            os.unlink(name)
+        except OSError:
+            pass
+        raise
+    return Path(name)
+
+
+def _write_temp_bytes(path, data):
+    descriptor, name = tempfile.mkstemp(
+        prefix="." + path.name + ".", suffix=".tmp", dir=str(path.parent),
+    )
+    try:
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(data)
+    except BaseException:
+        try:
+            os.unlink(name)
+        except OSError:
+            pass
+        raise
+    return Path(name)
+
+
+def _preserve_mode(source, target):
+    try:
+        os.chmod(str(target), os.stat(str(source)).st_mode & 0o777)
+    except OSError:
+        pass
+
+
+def _is_link_like(path):
+    try:
+        info = os.lstat(str(path))
+    except OSError:
+        return False
+    if stat.S_ISLNK(info.st_mode):
+        return True
+    attributes = getattr(info, "st_file_attributes", 0)
+    reparse_point = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0)
+    return bool(attributes & reparse_point)
+
+
+def _assert_no_symlink_path(path, root):
+    root = Path(root)
+    current = Path(path)
+    while True:
+        if _is_link_like(current):
+            raise ValueError("拒绝通过符号链接写入: %s" % current)
+        if current == root or current.parent == current:
+            break
+        current = current.parent
+
+
 def _atomic_write(path, content):
     path = Path(path)
     path.parent.mkdir(parents=True, exist_ok=True)
     backup = None
     if path.exists():
         backup = path.with_suffix(path.suffix + ".bak")
-        shutil.copy2(str(path), str(backup))
-    temporary = path.with_suffix(path.suffix + ".tmp")
-    temporary.write_text(content, encoding="utf-8")
+        temporary_backup = _write_temp_bytes(backup, path.read_bytes())
+        _preserve_mode(path, temporary_backup)
+        os.replace(str(temporary_backup), str(backup))
+    temporary = _write_temp_text(path, content)
+    if path.exists():
+        _preserve_mode(path, temporary)
     os.replace(str(temporary), str(path))
     return str(backup) if backup else None
 
@@ -964,6 +1053,7 @@ def workflow_state(root, action="read", date=None, text=None, file=None, apply=F
     body = (text or "").rstrip() + "\n"
     preview = body
     if apply:
+        _assert_no_symlink_path(target, Path(root))
         target.parent.mkdir(parents=True, exist_ok=True)
         if target.exists():
             existing = _read_text(target)

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/YottaMeta/yotta-dev-mcp",
     "source": "github"
   },
-  "version": "0.2.4",
+  "version": "0.2.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@yottameta/yotta-dev-mcp",
-      "version": "0.2.4",
+      "version": "0.2.5",
       "transport": {
         "type": "stdio"
       }