dsh-agy-link 0.4.76 → 0.4.77

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.4.77 (2026-10-29)
+
+### English
+
+- **Security(mcp): harden the loopback endpoint against a token-holding, prompt-injected child.**
+  - **Bounded request body** — `/call` now caps the buffered body at 8 MiB and returns **413 `request body too large`** instead of buffering an unbounded payload, so a compromised/injected agy child cannot OOM the host process by streaming huge tool arguments.
+  - **Constant-time bearer check** — the shared-secret token is compared with `crypto.timingSafeEqual` (length-guarded) rather than `!==`, removing the timing side-channel.
+
+### 中文
+
+- **安全(MCP)：加固 loopback 端点，防御持有 token、被提示词注入的子进程。**
+  - **请求体上限**：`/call` 现在把缓冲上限设为 8 MiB，超限直接返回 **413 `request body too large`**，避免被攻陷/注入的 agy 子进程用超大工具参数把宿主进程内存打爆。
+  - **常量时间 token 校验**：共享密钥改用 `crypto.timingSafeEqual`（先校验长度）比对，消除 `!==` 的时序侧信道。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.76...v0.4.77
+
 ## 0.4.76 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -6,7 +6,7 @@ import { homedir, tmpdir } from "node:os";
 import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { EventEmitter } from "node:events";
 import { createServer } from "node:http";
@@ -34660,14 +34660,41 @@ const INTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set([
 function toMcpName(name) {
 	return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
-function readBody(req) {
+/** Loopback request-body cap. Tool arguments are tiny; this only exists so a
+* token-holding (possibly prompt-injected) agy child cannot OOM the host by
+* streaming an unbounded body at /call. */
+const DEFAULT_MAX_BODY_BYTES = 8388608;
+function readBody(req, maxBytes) {
 	return new Promise((resolve) => {
 		const chunks = [];
-		req.on("data", (c) => chunks.push(c));
-		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-		req.on("error", () => resolve(""));
+		let size = 0;
+		let tooLarge = false;
+		req.on("data", (c) => {
+			size += c.length;
+			if (size > maxBytes) {
+				tooLarge = true;
+				chunks.length = 0;
+				return;
+			}
+			chunks.push(c);
+		});
+		req.on("end", () => resolve({
+			tooLarge,
+			text: tooLarge ? "" : Buffer.concat(chunks).toString("utf8")
+		}));
+		req.on("error", () => resolve({
+			tooLarge,
+			text: ""
+		}));
 	});
 }
+/** Constant-time bearer comparison (the token is a shared secret). */
+function bearerMatches(provided, expected) {
+	const a = Buffer.from(provided, "utf8");
+	const b = Buffer.from(expected, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
 function sendJson(res, status, body) {
 	const text = JSON.stringify(body);
 	res.writeHead(status, {
@@ -34706,7 +34733,7 @@ function startMcpBridge(opts) {
 	const server = createServer((req, res) => {
 		(async () => {
 			const url = (req.url ?? "").split("?")[0];
-			if (String(req.headers["authorization"] ?? "") !== "Bearer " + token) {
+			if (!bearerMatches(String(req.headers["authorization"] ?? ""), "Bearer " + token)) {
 				sendJson(res, 401, { error: "unauthorized" });
 				return;
 			}
@@ -34737,10 +34764,14 @@ function startMcpBridge(opts) {
 				return;
 			}
 			if (req.method === "POST" && (url === "/call" || url === "/mcp/call")) {
-				const body = await readBody(req);
+				const body = await readBody(req, opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+				if (body.tooLarge) {
+					sendJson(res, 413, { error: "request body too large" });
+					return;
+				}
 				let parsed = {};
 				try {
-					parsed = JSON.parse(body);
+					parsed = JSON.parse(body.text);
 				} catch {
 					sendJson(res, 400, { error: "invalid JSON" });
 					return;

package/docs/KNOWN-GAPS.md

@@ -116,7 +116,10 @@ reference-counted slot is the strongest isolation the plugin can provide.
   restricts the served set **and is
   enforced at execution time** — a `/call` for a tool outside the allowlist is
   refused (403) even when the caller holds the bridge token, so a prompt-injected
-  agy child cannot silently reach tools the operator did not expose.
+  agy child cannot silently reach tools the operator did not expose. The
+  loopback endpoint also caps request bodies (8 MiB → HTTP 413) and compares the
+  bearer token in constant time, so a token-holding but prompt-injected child
+  cannot OOM the host with an unbounded body or probe the token via timing.
   Every bridged call is audit-logged as `mcp call <tool> [<outcome>] <ms>` with
   the caller class and the failure text (never the arguments), so a failed run
   is visible in journald instead of only in transcripts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.76",
+  "version": "0.4.77",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",