dsh-agy-link 0.4.76 → 0.4.78

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.4.78 (2026-10-29)
+
+### English
+
+- **Refactor(mcp/http): one bounded JSON body reader for every HTTP surface.**
+  - Extracted `src/host/read-json-body.ts` and routed both the MCP bridge `/call` and all `/plugins/agy-link/*` web routes through it. Plugin payloads are tiny config JSON; the old unbounded buffer let any local client (including a prompt-injected agy child holding the bridge token) exhaust host memory by streaming a huge POST body. Bodies are now capped (1 MiB for plugin routes, 8 MiB for `/call`) and oversized ones are discarded. Adds focused unit tests for the reader (valid/malformed/array/oversized/stream-error).
+
+### 中文
+
+- **重构(mcp/http)：所有 HTTP 面共用同一个有界 JSON body 读取器。**
+  - 抽出 `src/host/read-json-body.ts`，MCP 桥接 `/call` 与全部 `/plugins/agy-link/*` Web 路由统一走它。插件请求体都是很小的配置 JSON，此前的无界缓冲会让任意本地客户端（包括持有桥接 token、被提示词注入的 agy 子进程）用超大 POST body 打爆宿主内存。现在缓冲有上限（插件路由 1 MiB、`/call` 8 MiB），超限直接丢弃。为该读取器补充了针对性单测（正常/非法/数组/超限/流错误）。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.77...v0.4.78
+
+## 0.4.77 (2026-10-29)
+
+### English
+
+- **Security(mcp): harden the loopback endpoint against a token-holding, prompt-injected child.**
+  - **Bounded request body** — `/call` now caps the buffered body at 8 MiB and returns **413 `request body too large`** instead of buffering an unbounded payload, so a compromised/injected agy child cannot OOM the host process by streaming huge tool arguments.
+  - **Constant-time bearer check** — the shared-secret token is compared with `crypto.timingSafeEqual` (length-guarded) rather than `!==`, removing the timing side-channel.
+
+### 中文
+
+- **安全(MCP)：加固 loopback 端点，防御持有 token、被提示词注入的子进程。**
+  - **请求体上限**：`/call` 现在把缓冲上限设为 8 MiB，超限直接返回 **413 `request body too large`**，避免被攻陷/注入的 agy 子进程用超大工具参数把宿主进程内存打爆。
+  - **常量时间 token 校验**：共享密钥改用 `crypto.timingSafeEqual`（先校验长度）比对，消除 `!==` 的时序侧信道。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.76...v0.4.77
+
 ## 0.4.76 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -6,7 +6,7 @@ import { homedir, tmpdir } from "node:os";
 import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { EventEmitter } from "node:events";
 import { createServer } from "node:http";
@@ -34639,6 +34639,57 @@ var WarmupService = class {
 		return this.warmupAllAccounts({ force: false });
 	}
 };
+function readJsonBody(req, opts = {}) {
+	const maxBytes = opts.maxBytes ?? 1048576;
+	const emitter = req;
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let tooLarge = false;
+		const done = (result) => resolve(result);
+		emitter.on?.("data", (chunk) => {
+			const buf = chunk ?? Buffer.alloc(0);
+			size += buf.length;
+			if (size > maxBytes) {
+				tooLarge = true;
+				chunks.length = 0;
+				return;
+			}
+			chunks.push(buf);
+		});
+		emitter.on?.("end", () => {
+			if (tooLarge) return done({
+				value: {},
+				tooLarge: true,
+				invalid: false
+			});
+			try {
+				const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+				if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return done({
+					value: parsed,
+					tooLarge: false,
+					invalid: false
+				});
+				return done({
+					value: {},
+					tooLarge: false,
+					invalid: true
+				});
+			} catch {
+				return done({
+					value: {},
+					tooLarge: false,
+					invalid: true
+				});
+			}
+		});
+		emitter.on?.("error", () => done({
+			value: {},
+			tooLarge: false,
+			invalid: true
+		}));
+	});
+}
 //#endregion
 //#region src/host/mcp-bridge.ts
 const MCP_SERVER_KEY = "dsh-tools";
@@ -34660,13 +34711,17 @@ const INTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set([
 function toMcpName(name) {
 	return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
-function readBody(req) {
-	return new Promise((resolve) => {
-		const chunks = [];
-		req.on("data", (c) => chunks.push(c));
-		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-		req.on("error", () => resolve(""));
-	});
+/** Loopback request-body cap for /call. Tool arguments are tiny; this only
+* exists so a token-holding (possibly prompt-injected) agy child cannot OOM the
+* host by streaming an unbounded body. The bounded reader itself is shared with
+* the plugin's web routes (see ./read-json-body.ts). */
+const MCP_MAX_BODY_BYTES = 8388608;
+/** Constant-time bearer comparison (the token is a shared secret). */
+function bearerMatches(provided, expected) {
+	const a = Buffer.from(provided, "utf8");
+	const b = Buffer.from(expected, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
 }
 function sendJson(res, status, body) {
 	const text = JSON.stringify(body);
@@ -34706,7 +34761,7 @@ function startMcpBridge(opts) {
 	const server = createServer((req, res) => {
 		(async () => {
 			const url = (req.url ?? "").split("?")[0];
-			if (String(req.headers["authorization"] ?? "") !== "Bearer " + token) {
+			if (!bearerMatches(String(req.headers["authorization"] ?? ""), "Bearer " + token)) {
 				sendJson(res, 401, { error: "unauthorized" });
 				return;
 			}
@@ -34737,14 +34792,16 @@ function startMcpBridge(opts) {
 				return;
 			}
 			if (req.method === "POST" && (url === "/call" || url === "/mcp/call")) {
-				const body = await readBody(req);
-				let parsed = {};
-				try {
-					parsed = JSON.parse(body);
-				} catch {
+				const body = await readJsonBody(req, { maxBytes: opts.maxBodyBytes ?? MCP_MAX_BODY_BYTES });
+				if (body.tooLarge) {
+					sendJson(res, 413, { error: "request body too large" });
+					return;
+				}
+				if (body.invalid) {
 					sendJson(res, 400, { error: "invalid JSON" });
 					return;
 				}
+				const parsed = body.value;
 				const svc = opts.tools();
 				if (!svc) {
 					sendJson(res, 503, { error: "tools service unavailable" });
@@ -35462,20 +35519,10 @@ function apply(ctx, entryConfig = {}) {
 			res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
 			res.end(JSON.stringify(body));
 		};
-		const readBody = (req, strict = false) => {
-			const r = req;
-			return new Promise((resolve) => {
-				const chunks = [];
-				r.on?.("data", (c) => chunks.push(c));
-				r.on?.("end", () => {
-					try {
-						const v = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-						resolve(v && typeof v === "object" ? v : {});
-					} catch {
-						resolve(strict ? { __invalidJson: true } : {});
-					}
-				});
-			});
+		const readBody = async (req, strict = false) => {
+			const result = await readJsonBody(req);
+			if (result.invalid || result.tooLarge) return strict ? { __invalidJson: true } : {};
+			return result.value;
 		};
 		const methodOf = (req) => {
 			const m = req.method;

package/docs/KNOWN-GAPS.md

@@ -116,7 +116,10 @@ reference-counted slot is the strongest isolation the plugin can provide.
   restricts the served set **and is
   enforced at execution time** — a `/call` for a tool outside the allowlist is
   refused (403) even when the caller holds the bridge token, so a prompt-injected
-  agy child cannot silently reach tools the operator did not expose.
+  agy child cannot silently reach tools the operator did not expose. The
+  loopback endpoint also caps request bodies (8 MiB → HTTP 413) and compares the
+  bearer token in constant time, so a token-holding but prompt-injected child
+  cannot OOM the host with an unbounded body or probe the token via timing.
   Every bridged call is audit-logged as `mcp call <tool> [<outcome>] <ms>` with
   the caller class and the failure text (never the arguments), so a failed run
   is visible in journald instead of only in transcripts.

package/docs/SECURITY-NOTES.md

@@ -44,3 +44,15 @@ choice, not a fallback applied by this plugin.
 `/agy doctor` writes its report with redaction: Google auth URLs,
 `4/...` authorization codes, `ya29.*` tokens, and `Bearer` headers are
 stripped before the file hits disk. Still read it before attaching.
+
+## HTTP surfaces and request-body caps
+
+- The plugin's web routes (`/plugins/agy-link/*`) and the experimental loopback
+  MCP bridge (`/call`) share one bounded JSON body reader
+  (`src/host/read-json-body.ts`): bodies are capped (1 MiB for plugin routes,
+  8 MiB for `/call`) and oversized bodies are discarded rather than buffered, so
+  a local client — including a prompt-injected agy child holding the bridge token
+  — cannot exhaust host memory by streaming a huge POST body.
+- The MCP bridge binds to `127.0.0.1` only, requires a per-process random bearer
+  token compared in constant time, enforces `mcpToolAllowlist` at execution time,
+  and never exposes the internal `run_code`/`agy_ask`/`agy_tool` tools.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.76",
+  "version": "0.4.78",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",