dsh-agy-link 0.4.75 → 0.4.76

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.4.76 (2026-10-29)
+
+### English
+
+- **Security(mcp): enforce `mcpToolAllowlist` at execution time, not just on `/tools`.**
+  - `GET /tools` filtered the served set by `mcpToolAllowlist`, but `POST /call` accepted any tool name (except the internal `run_code`/`agy_ask`). The agy child holds the bridge bearer token, so a prompt-injected or compromised child could `POST /call` for a tool the operator never exposed (e.g. `bash`, `write`) and bypass the allowlist entirely. `/call` now returns **403 `tool not allowed`** for any tool outside a non-empty allowlist, and audit-logs it as `mcp call <tool> [denied: not in allowlist]`. Empty allowlist still means "all non-internal tools" (unchanged).
+- **Security(mcp): stop exposing the internal `agy_tool` mirror over the bridge.**
+  - The internal-tool filter only excluded `run_code`/`agy_ask`, so the activity-mirror tool `agy_tool` (which replays recorded agy tool activity back into DSH) was listed by `/tools` and executable via `/call` — letting the external agy child re-enter the bridge. The exclusion set is now centralized (`INTERNAL_TOOL_NAMES = run_code, agy_ask, agy_tool`) and enforced identically when listing and when executing, so the two can never drift.
+
+### 中文
+
+- **安全(MCP)：`mcpToolAllowlist` 现在在「执行时」强制生效，而不只是过滤 `/tools` 列表。**
+  - 此前 `/tools` 按 allowlist 过滤，但 `POST /call` 只拦内部 `run_code`/`agy_ask`，任意工具名都会被真正执行。agy 子进程本身持有桥接 token，因此被提示词注入或攻陷的子进程可以 `POST /call` 调用运维并未暴露的工具（如 `bash`、`write`），完全绕过 allowlist。现在非空 allowlist 之外的 `/call` 一律返回 **403 `tool not allowed`**，并审计为 `mcp call <tool> [denied: not in allowlist]`。空 allowlist 仍表示「全部非内部工具」（行为不变）。
+- **安全(MCP)：不再把内部的 `agy_tool` 镜像工具暴露给桥接。**
+  - 内部工具过滤此前只排除 `run_code`/`agy_ask`，导致「活动镜像」工具 `agy_tool`（把 agy 记录的工具活动回放到 DSH）会被 `/tools` 列出、并可经 `/call` 执行，等于让外部 agy 子进程重新进入桥接。现将内部工具集合集中为 `INTERNAL_TOOL_NAMES = run_code, agy_ask, agy_tool`，在「列出」与「执行」两处统一生效，避免两处漂移。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.75...v0.4.76
+
 ## 0.4.75 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -34642,6 +34642,20 @@ var WarmupService = class {
 //#endregion
 //#region src/host/mcp-bridge.ts
 const MCP_SERVER_KEY = "dsh-tools";
+/**
+* Tools that must NEVER be exposed to an external MCP client. These are
+* internal transports / loopback-only helpers of the plugin itself:
+*  - `run_code`  — the deployment's model-only wrapper around code execution.
+*  - `agy_ask`   — the plugin's own ask tool (would recurse into agy).
+*  - `agy_tool`  — replays recorded agy tool activity back into DSH; calling it
+*                   over the bridge would let the agy child re-enter the bridge.
+* Kept in one place so the /tools listing and the /call guard can never drift.
+*/
+const INTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"run_code",
+	"agy_ask",
+	"agy_tool"
+]);
 /** MCP tool names are [a-zA-Z0-9_-]; DSH names may contain dots. */
 function toMcpName(name) {
 	return name.replace(/[^a-zA-Z0-9_-]/g, "_");
@@ -34706,7 +34720,7 @@ function startMcpBridge(opts) {
 				const allowSet = new Set(allow);
 				const seen = /* @__PURE__ */ new Set();
 				sendJson(res, 200, { tools: svc.schemas().filter((t) => allow.length === 0 || allowSet.has(t.name)).filter((t) => {
-					if (t.name === "run_code" || t.name === "agy_ask") return false;
+					if (INTERNAL_TOOL_NAMES.has(t.name)) return false;
 					const mapped = toMcpName(t.name);
 					if (seen.has(mapped)) return false;
 					seen.add(mapped);
@@ -34737,7 +34751,7 @@ function startMcpBridge(opts) {
 					return;
 				}
 				const dshName = typeof parsed.dshName === "string" ? parsed.dshName : "";
-				if (dshName === "" || dshName === "run_code" || dshName === "agy_ask") {
+				if (dshName === "" || INTERNAL_TOOL_NAMES.has(dshName)) {
 					sendJson(res, 400, { error: "bad tool name" });
 					return;
 				}
@@ -34748,6 +34762,12 @@ function startMcpBridge(opts) {
 						opts.log?.("mcp call " + dshName + " [" + outcome + "] " + (Date.now() - startedAt) + "ms");
 					} catch {}
 				};
+				const allow = opts.allowlist().split(",").map((s) => s.trim()).filter(Boolean);
+				if (allow.length > 0 && !allow.includes(dshName)) {
+					audit("denied: not in allowlist");
+					sendJson(res, 403, { error: "tool not allowed" });
+					return;
+				}
 				try {
 					const sessionHeader = String(req.headers["x-dsh-session"] ?? "");
 					const resolveSession = async (id) => id === "" ? void 0 : await Promise.resolve(opts.resolveAgent?.(id));

package/docs/KNOWN-GAPS.md

@@ -110,11 +110,31 @@ reference-counted slot is the strongest isolation the plugin can provide.
   server in the MCP registry (`~/.gemini/config/mcp_config.json` by default,
   where `agy` 1.4+ actually reads it, merged in and restored on disable).
   Bridged calls carry caller identity via `DSH_MCP_SESSION` so identity-enforcing
-  tools (such as `agent_teams`) function correctly. `run_code` and `agy_ask`
-  are never bridged; `mcpToolAllowlist` restricts the set further.
+  tools (such as `agent_teams`) function correctly. Internal loopback-only
+  helpers — `run_code`, `agy_ask`, and the activity-mirror `agy_tool` — are
+  never bridged (excluded from both `/tools` and `/call`); `mcpToolAllowlist`
+  restricts the served set **and is
+  enforced at execution time** — a `/call` for a tool outside the allowlist is
+  refused (403) even when the caller holds the bridge token, so a prompt-injected
+  agy child cannot silently reach tools the operator did not expose.
   Every bridged call is audit-logged as `mcp call <tool> [<outcome>] <ms>` with
   the caller class and the failure text (never the arguments), so a failed run
   is visible in journald instead of only in transcripts.
+
+  **Contract for external / plugin callers of `tools.execute(exec)` (see #61):**
+  DSH's `ToolExecutionInput` requires `callId`, `name`, `arguments` **and
+  `signal: AbortSignal`** — a call without `signal` throws
+  `Cannot read properties of undefined (reading 'aborted')` inside any tool
+  that awaits. Omit `agent` entirely when there is no real session (leave it
+  `undefined`, **never** `null`: DSH checks `exec.agent === void 0`, so `null`
+  takes the else branch and reads `null.session`). This plugin's host-side
+  `/call` handler already does both (it mints an `AbortController` per call and
+  resolves the caller from the `x-dsh-session` header, passing `agent` only when
+  one is found). A fabricated `agent.session` cannot pass DSH's live-session
+  store check — there is no supported way to fake a real Session from outside;
+  tools that require one need a real `agent` or they fail by design.
+  Documenting the full DSH-core `execute(exec)` contract and any official
+  sessionless-execution API is upstream work, not this bundle.
 - **DSH `send_message` from an agy child** - DSH's sub-agent runtime appends a
   footer telling the child to report with `send_message({ agent_id: <parent> })`.
   In an agy run that name resolves to agy's **own** `send_message`, which does

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.75",
+  "version": "0.4.76",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",