dsh-agy-link 0.4.75 → 0.4.77

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.4.77 (2026-10-29)
+
+### English
+
+- **Security(mcp): harden the loopback endpoint against a token-holding, prompt-injected child.**
+  - **Bounded request body** — `/call` now caps the buffered body at 8 MiB and returns **413 `request body too large`** instead of buffering an unbounded payload, so a compromised/injected agy child cannot OOM the host process by streaming huge tool arguments.
+  - **Constant-time bearer check** — the shared-secret token is compared with `crypto.timingSafeEqual` (length-guarded) rather than `!==`, removing the timing side-channel.
+
+### 中文
+
+- **安全(MCP)：加固 loopback 端点，防御持有 token、被提示词注入的子进程。**
+  - **请求体上限**：`/call` 现在把缓冲上限设为 8 MiB，超限直接返回 **413 `request body too large`**，避免被攻陷/注入的 agy 子进程用超大工具参数把宿主进程内存打爆。
+  - **常量时间 token 校验**：共享密钥改用 `crypto.timingSafeEqual`（先校验长度）比对，消除 `!==` 的时序侧信道。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.76...v0.4.77
+
+## 0.4.76 (2026-10-29)
+
+### English
+
+- **Security(mcp): enforce `mcpToolAllowlist` at execution time, not just on `/tools`.**
+  - `GET /tools` filtered the served set by `mcpToolAllowlist`, but `POST /call` accepted any tool name (except the internal `run_code`/`agy_ask`). The agy child holds the bridge bearer token, so a prompt-injected or compromised child could `POST /call` for a tool the operator never exposed (e.g. `bash`, `write`) and bypass the allowlist entirely. `/call` now returns **403 `tool not allowed`** for any tool outside a non-empty allowlist, and audit-logs it as `mcp call <tool> [denied: not in allowlist]`. Empty allowlist still means "all non-internal tools" (unchanged).
+- **Security(mcp): stop exposing the internal `agy_tool` mirror over the bridge.**
+  - The internal-tool filter only excluded `run_code`/`agy_ask`, so the activity-mirror tool `agy_tool` (which replays recorded agy tool activity back into DSH) was listed by `/tools` and executable via `/call` — letting the external agy child re-enter the bridge. The exclusion set is now centralized (`INTERNAL_TOOL_NAMES = run_code, agy_ask, agy_tool`) and enforced identically when listing and when executing, so the two can never drift.
+
+### 中文
+
+- **安全(MCP)：`mcpToolAllowlist` 现在在「执行时」强制生效，而不只是过滤 `/tools` 列表。**
+  - 此前 `/tools` 按 allowlist 过滤，但 `POST /call` 只拦内部 `run_code`/`agy_ask`，任意工具名都会被真正执行。agy 子进程本身持有桥接 token，因此被提示词注入或攻陷的子进程可以 `POST /call` 调用运维并未暴露的工具（如 `bash`、`write`），完全绕过 allowlist。现在非空 allowlist 之外的 `/call` 一律返回 **403 `tool not allowed`**，并审计为 `mcp call <tool> [denied: not in allowlist]`。空 allowlist 仍表示「全部非内部工具」（行为不变）。
+- **安全(MCP)：不再把内部的 `agy_tool` 镜像工具暴露给桥接。**
+  - 内部工具过滤此前只排除 `run_code`/`agy_ask`，导致「活动镜像」工具 `agy_tool`（把 agy 记录的工具活动回放到 DSH）会被 `/tools` 列出、并可经 `/call` 执行，等于让外部 agy 子进程重新进入桥接。现将内部工具集合集中为 `INTERNAL_TOOL_NAMES = run_code, agy_ask, agy_tool`，在「列出」与「执行」两处统一生效，避免两处漂移。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.75...v0.4.76
+
 ## 0.4.75 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -6,7 +6,7 @@ import { homedir, tmpdir } from "node:os";
 import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { EventEmitter } from "node:events";
 import { createServer } from "node:http";
@@ -34642,18 +34642,59 @@ var WarmupService = class {
 //#endregion
 //#region src/host/mcp-bridge.ts
 const MCP_SERVER_KEY = "dsh-tools";
+/**
+* Tools that must NEVER be exposed to an external MCP client. These are
+* internal transports / loopback-only helpers of the plugin itself:
+*  - `run_code`  — the deployment's model-only wrapper around code execution.
+*  - `agy_ask`   — the plugin's own ask tool (would recurse into agy).
+*  - `agy_tool`  — replays recorded agy tool activity back into DSH; calling it
+*                   over the bridge would let the agy child re-enter the bridge.
+* Kept in one place so the /tools listing and the /call guard can never drift.
+*/
+const INTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"run_code",
+	"agy_ask",
+	"agy_tool"
+]);
 /** MCP tool names are [a-zA-Z0-9_-]; DSH names may contain dots. */
 function toMcpName(name) {
 	return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
-function readBody(req) {
+/** Loopback request-body cap. Tool arguments are tiny; this only exists so a
+* token-holding (possibly prompt-injected) agy child cannot OOM the host by
+* streaming an unbounded body at /call. */
+const DEFAULT_MAX_BODY_BYTES = 8388608;
+function readBody(req, maxBytes) {
 	return new Promise((resolve) => {
 		const chunks = [];
-		req.on("data", (c) => chunks.push(c));
-		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-		req.on("error", () => resolve(""));
+		let size = 0;
+		let tooLarge = false;
+		req.on("data", (c) => {
+			size += c.length;
+			if (size > maxBytes) {
+				tooLarge = true;
+				chunks.length = 0;
+				return;
+			}
+			chunks.push(c);
+		});
+		req.on("end", () => resolve({
+			tooLarge,
+			text: tooLarge ? "" : Buffer.concat(chunks).toString("utf8")
+		}));
+		req.on("error", () => resolve({
+			tooLarge,
+			text: ""
+		}));
 	});
 }
+/** Constant-time bearer comparison (the token is a shared secret). */
+function bearerMatches(provided, expected) {
+	const a = Buffer.from(provided, "utf8");
+	const b = Buffer.from(expected, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
 function sendJson(res, status, body) {
 	const text = JSON.stringify(body);
 	res.writeHead(status, {
@@ -34692,7 +34733,7 @@ function startMcpBridge(opts) {
 	const server = createServer((req, res) => {
 		(async () => {
 			const url = (req.url ?? "").split("?")[0];
-			if (String(req.headers["authorization"] ?? "") !== "Bearer " + token) {
+			if (!bearerMatches(String(req.headers["authorization"] ?? ""), "Bearer " + token)) {
 				sendJson(res, 401, { error: "unauthorized" });
 				return;
 			}
@@ -34706,7 +34747,7 @@ function startMcpBridge(opts) {
 				const allowSet = new Set(allow);
 				const seen = /* @__PURE__ */ new Set();
 				sendJson(res, 200, { tools: svc.schemas().filter((t) => allow.length === 0 || allowSet.has(t.name)).filter((t) => {
-					if (t.name === "run_code" || t.name === "agy_ask") return false;
+					if (INTERNAL_TOOL_NAMES.has(t.name)) return false;
 					const mapped = toMcpName(t.name);
 					if (seen.has(mapped)) return false;
 					seen.add(mapped);
@@ -34723,10 +34764,14 @@ function startMcpBridge(opts) {
 				return;
 			}
 			if (req.method === "POST" && (url === "/call" || url === "/mcp/call")) {
-				const body = await readBody(req);
+				const body = await readBody(req, opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+				if (body.tooLarge) {
+					sendJson(res, 413, { error: "request body too large" });
+					return;
+				}
 				let parsed = {};
 				try {
-					parsed = JSON.parse(body);
+					parsed = JSON.parse(body.text);
 				} catch {
 					sendJson(res, 400, { error: "invalid JSON" });
 					return;
@@ -34737,7 +34782,7 @@ function startMcpBridge(opts) {
 					return;
 				}
 				const dshName = typeof parsed.dshName === "string" ? parsed.dshName : "";
-				if (dshName === "" || dshName === "run_code" || dshName === "agy_ask") {
+				if (dshName === "" || INTERNAL_TOOL_NAMES.has(dshName)) {
 					sendJson(res, 400, { error: "bad tool name" });
 					return;
 				}
@@ -34748,6 +34793,12 @@ function startMcpBridge(opts) {
 						opts.log?.("mcp call " + dshName + " [" + outcome + "] " + (Date.now() - startedAt) + "ms");
 					} catch {}
 				};
+				const allow = opts.allowlist().split(",").map((s) => s.trim()).filter(Boolean);
+				if (allow.length > 0 && !allow.includes(dshName)) {
+					audit("denied: not in allowlist");
+					sendJson(res, 403, { error: "tool not allowed" });
+					return;
+				}
 				try {
 					const sessionHeader = String(req.headers["x-dsh-session"] ?? "");
 					const resolveSession = async (id) => id === "" ? void 0 : await Promise.resolve(opts.resolveAgent?.(id));

package/docs/KNOWN-GAPS.md

@@ -110,11 +110,34 @@ reference-counted slot is the strongest isolation the plugin can provide.
   server in the MCP registry (`~/.gemini/config/mcp_config.json` by default,
   where `agy` 1.4+ actually reads it, merged in and restored on disable).
   Bridged calls carry caller identity via `DSH_MCP_SESSION` so identity-enforcing
-  tools (such as `agent_teams`) function correctly. `run_code` and `agy_ask`
-  are never bridged; `mcpToolAllowlist` restricts the set further.
+  tools (such as `agent_teams`) function correctly. Internal loopback-only
+  helpers — `run_code`, `agy_ask`, and the activity-mirror `agy_tool` — are
+  never bridged (excluded from both `/tools` and `/call`); `mcpToolAllowlist`
+  restricts the served set **and is
+  enforced at execution time** — a `/call` for a tool outside the allowlist is
+  refused (403) even when the caller holds the bridge token, so a prompt-injected
+  agy child cannot silently reach tools the operator did not expose. The
+  loopback endpoint also caps request bodies (8 MiB → HTTP 413) and compares the
+  bearer token in constant time, so a token-holding but prompt-injected child
+  cannot OOM the host with an unbounded body or probe the token via timing.
   Every bridged call is audit-logged as `mcp call <tool> [<outcome>] <ms>` with
   the caller class and the failure text (never the arguments), so a failed run
   is visible in journald instead of only in transcripts.
+
+  **Contract for external / plugin callers of `tools.execute(exec)` (see #61):**
+  DSH's `ToolExecutionInput` requires `callId`, `name`, `arguments` **and
+  `signal: AbortSignal`** — a call without `signal` throws
+  `Cannot read properties of undefined (reading 'aborted')` inside any tool
+  that awaits. Omit `agent` entirely when there is no real session (leave it
+  `undefined`, **never** `null`: DSH checks `exec.agent === void 0`, so `null`
+  takes the else branch and reads `null.session`). This plugin's host-side
+  `/call` handler already does both (it mints an `AbortController` per call and
+  resolves the caller from the `x-dsh-session` header, passing `agent` only when
+  one is found). A fabricated `agent.session` cannot pass DSH's live-session
+  store check — there is no supported way to fake a real Session from outside;
+  tools that require one need a real `agent` or they fail by design.
+  Documenting the full DSH-core `execute(exec)` contract and any official
+  sessionless-execution API is upstream work, not this bundle.
 - **DSH `send_message` from an agy child** - DSH's sub-agent runtime appends a
   footer telling the child to report with `send_message({ agent_id: <parent> })`.
   In an agy run that name resolves to agy's **own** `send_message`, which does

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.75",
+  "version": "0.4.77",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",