cloudflare-mcp-smart-proxy 1.4.1 → 1.4.2

package/connector-cli.js

@@ -29,6 +29,7 @@ function printUsage() {
   console.error('  --app-server-socket <path> Current runtime Codex app-server socket');
   console.error('  --runtime-id <id>          Current Codex runtime identity');
   console.error('  --dry-run                  Show output without writing');
+  console.error('  --show-secrets             Explicitly include credentials in print output');
   console.error('');
   console.error('The reload codex command uses the existing Codex config and requires no credentials.');
 }
@@ -47,8 +48,8 @@ function parseArgs(argv) {
     }
 
     const key = token.slice(2);
-    if (key === 'dry-run') {
-      options.dryRun = true;
+    if (key === 'dry-run' || key === 'show-secrets') {
+      options[key === 'dry-run' ? 'dryRun' : key] = true;
       continue;
     }
 
@@ -95,7 +96,7 @@ function buildInstallOptions(options) {
   };
 }
 
-function printInstallResult(result, { includeContent = false } = {}) {
+function printInstallResult(result, { includeContent = false, includeSecrets = false } = {}) {
   console.error(`ecosystem: ${result.ecosystem}`);
   console.error(`scope: ${result.scope}`);
   console.error(`target: ${result.targetFile}`);
@@ -111,7 +112,11 @@ function printInstallResult(result, { includeContent = false } = {}) {
     }
   }
   if (includeContent) {
-    process.stdout.write(`${result.renderedContent}\n`);
+    const apiKey = result.serverDefinition?.env?.CLOUDFLARE_MCP_API_KEY || '';
+    const renderedContent = includeSecrets
+      ? result.renderedContent
+      : (apiKey ? result.renderedContent.split(apiKey).join('[REDACTED]') : result.renderedContent);
+    process.stdout.write(`${renderedContent}\n`);
   }
 }
 
@@ -177,7 +182,7 @@ async function main() {
 
     if (options.command === 'print') {
       const result = printReferenceConnectorConfig(buildInstallOptions(options));
-      printInstallResult(result, { includeContent: true });
+      printInstallResult(result, { includeContent: true, includeSecrets: options['show-secrets'] === true });
       return;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-mcp-smart-proxy",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Smart proxy for Cloudflare MCP - routes tools to cloud or local execution",
   "repository": {
     "type": "git",
@@ -36,7 +36,9 @@
       "@hono/node-server": "2.0.12",
       "ajv": "8.20.0",
       "body-parser": "2.3.0",
-      "fast-uri": "3.1.4",
+      "fast-uri": "3.1.5",
+      "hono": "4.12.34",
+      "ip-address": "10.4.0",
       "path-to-regexp": "8.4.0",
       "qs": "6.15.3"
     }

package/src/local-tools.js

@@ -214,13 +214,13 @@ export class LocalToolExecutor {
       },
       {
         name: 'execute_command',
-        description: 'Execute a shell command locally',
+        description: 'Execute a local process without shell interpretation',
         inputSchema: {
           type: 'object',
           properties: {
             command: {
               type: 'string',
-              description: 'Shell command to execute'
+              description: 'Executable and arguments to run'
             },
             cwd: {
               type: 'string',

package/src/tools/command-executor.js

@@ -4,6 +4,17 @@
 
 import { spawn } from 'child_process';
 import path from 'path';
+import { FileOperations } from './file-operations.js';
+
+function parseCommand(command) {
+  const tokens = [];
+  const pattern = /"((?:\\.|[^"\\])*)"|'([^']*)'|([^\s]+)/g;
+  let match;
+  while ((match = pattern.exec(command)) !== null) {
+    tokens.push((match[1] ?? match[2] ?? match[3]).replace(/\\([\\"])/g, '$1'));
+  }
+  return tokens;
+}
 
 export class CommandExecutor {
   /**
@@ -16,17 +27,21 @@ export class CommandExecutor {
       throw new Error('command parameter is required');
     }
     
-    const workingDir = cwd ? path.resolve(workspaceRoot, cwd) : workspaceRoot;
+    const workingDir = cwd ? FileOperations.validatePath(cwd, workspaceRoot) : FileOperations.validatePath('.', workspaceRoot);
     
     return new Promise((resolve, reject) => {
       // 解析命令和参数
-      const parts = command.trim().split(/\s+/);
+      const parts = parseCommand(command.trim());
       const cmd = parts[0];
       const args = parts.slice(1);
+      if (!cmd) {
+        reject(new Error('command parameter must include an executable'));
+        return;
+      }
       
       // 安全限制：禁止某些危险命令
-      const dangerousCommands = ['rm', 'del', 'format', 'shutdown', 'reboot'];
-      if (dangerousCommands.some(danger => cmd.includes(danger))) {
+      const dangerousCommands = new Set(['rm', 'del', 'format', 'shutdown', 'reboot']);
+      if (dangerousCommands.has(path.basename(cmd).toLowerCase())) {
         reject(new Error(`Command "${cmd}" is not allowed for security reasons`));
         return;
       }
@@ -38,9 +53,13 @@ export class CommandExecutor {
       // 执行命令
       const proc = spawn(cmd, args, {
         cwd: workingDir,
-        shell: true,
+        shell: false,
         stdio: ['ignore', 'pipe', 'pipe']
       });
+      const timeout = setTimeout(() => {
+        proc.kill();
+        reject(new Error('Command execution timeout (30s)'));
+      }, 30000);
       
       // 收集输出
       proc.stdout.on('data', (data) => {
@@ -53,6 +72,7 @@ export class CommandExecutor {
       
       // 处理完成
       proc.on('close', (code) => {
+        clearTimeout(timeout);
         const duration = Date.now() - startTime;
         
         resolve({
@@ -68,15 +88,9 @@ export class CommandExecutor {
       
       // 处理错误
       proc.on('error', (error) => {
+        clearTimeout(timeout);
         reject(new Error(`Command execution failed: ${error.message}`));
       });
-      
-      // 超时保护（30秒）
-      setTimeout(() => {
-        proc.kill();
-        reject(new Error('Command execution timeout (30s)'));
-      }, 30000);
     });
   }
 }
-

package/src/tools/file-operations.js

@@ -3,6 +3,7 @@
  */
 
 import fs from 'fs/promises';
+import fsSync from 'fs';
 import path from 'path';
 
 export class FileOperations {
@@ -16,14 +17,28 @@ export class FileOperations {
     }
     
     // 限制在工作目录内
-    const resolvedPath = path.resolve(workspaceRoot, filePath);
-    const resolvedRoot = path.resolve(workspaceRoot);
+    const resolvedRoot = fsSync.realpathSync(path.resolve(workspaceRoot));
+    const resolvedPath = path.resolve(resolvedRoot, filePath);
+    const relativePath = path.relative(resolvedRoot, resolvedPath);
     
-    if (!resolvedPath.startsWith(resolvedRoot)) {
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
       throw new Error('File path outside workspace root');
     }
-    
-    return resolvedPath;
+
+    let existingAncestor = resolvedPath;
+    while (!fsSync.existsSync(existingAncestor)) {
+      const parent = path.dirname(existingAncestor);
+      if (parent === existingAncestor) break;
+      existingAncestor = parent;
+    }
+    const realAncestor = fsSync.realpathSync(existingAncestor);
+    const realTarget = path.resolve(realAncestor, path.relative(existingAncestor, resolvedPath));
+    const realRelativePath = path.relative(resolvedRoot, realTarget);
+    if (realRelativePath.startsWith('..') || path.isAbsolute(realRelativePath)) {
+      throw new Error('File path resolves outside workspace root');
+    }
+
+    return realTarget;
   }
 
   /**
@@ -208,4 +223,3 @@ export class FileOperations {
     }
   }
 }
-