dsh-agy-link 0.4.77 → 0.4.78

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.4.78 (2026-10-29)
+
+### English
+
+- **Refactor(mcp/http): one bounded JSON body reader for every HTTP surface.**
+  - Extracted `src/host/read-json-body.ts` and routed both the MCP bridge `/call` and all `/plugins/agy-link/*` web routes through it. Plugin payloads are tiny config JSON; the old unbounded buffer let any local client (including a prompt-injected agy child holding the bridge token) exhaust host memory by streaming a huge POST body. Bodies are now capped (1 MiB for plugin routes, 8 MiB for `/call`) and oversized ones are discarded. Adds focused unit tests for the reader (valid/malformed/array/oversized/stream-error).
+
+### 中文
+
+- **重构(mcp/http)：所有 HTTP 面共用同一个有界 JSON body 读取器。**
+  - 抽出 `src/host/read-json-body.ts`，MCP 桥接 `/call` 与全部 `/plugins/agy-link/*` Web 路由统一走它。插件请求体都是很小的配置 JSON，此前的无界缓冲会让任意本地客户端（包括持有桥接 token、被提示词注入的 agy 子进程）用超大 POST body 打爆宿主内存。现在缓冲有上限（插件路由 1 MiB、`/call` 8 MiB），超限直接丢弃。为该读取器补充了针对性单测（正常/非法/数组/超限/流错误）。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.77...v0.4.78
+
 ## 0.4.77 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -34639,6 +34639,57 @@ var WarmupService = class {
 		return this.warmupAllAccounts({ force: false });
 	}
 };
+function readJsonBody(req, opts = {}) {
+	const maxBytes = opts.maxBytes ?? 1048576;
+	const emitter = req;
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let tooLarge = false;
+		const done = (result) => resolve(result);
+		emitter.on?.("data", (chunk) => {
+			const buf = chunk ?? Buffer.alloc(0);
+			size += buf.length;
+			if (size > maxBytes) {
+				tooLarge = true;
+				chunks.length = 0;
+				return;
+			}
+			chunks.push(buf);
+		});
+		emitter.on?.("end", () => {
+			if (tooLarge) return done({
+				value: {},
+				tooLarge: true,
+				invalid: false
+			});
+			try {
+				const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+				if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return done({
+					value: parsed,
+					tooLarge: false,
+					invalid: false
+				});
+				return done({
+					value: {},
+					tooLarge: false,
+					invalid: true
+				});
+			} catch {
+				return done({
+					value: {},
+					tooLarge: false,
+					invalid: true
+				});
+			}
+		});
+		emitter.on?.("error", () => done({
+			value: {},
+			tooLarge: false,
+			invalid: true
+		}));
+	});
+}
 //#endregion
 //#region src/host/mcp-bridge.ts
 const MCP_SERVER_KEY = "dsh-tools";
@@ -34660,34 +34711,11 @@ const INTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set([
 function toMcpName(name) {
 	return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
-/** Loopback request-body cap. Tool arguments are tiny; this only exists so a
-* token-holding (possibly prompt-injected) agy child cannot OOM the host by
-* streaming an unbounded body at /call. */
-const DEFAULT_MAX_BODY_BYTES = 8388608;
-function readBody(req, maxBytes) {
-	return new Promise((resolve) => {
-		const chunks = [];
-		let size = 0;
-		let tooLarge = false;
-		req.on("data", (c) => {
-			size += c.length;
-			if (size > maxBytes) {
-				tooLarge = true;
-				chunks.length = 0;
-				return;
-			}
-			chunks.push(c);
-		});
-		req.on("end", () => resolve({
-			tooLarge,
-			text: tooLarge ? "" : Buffer.concat(chunks).toString("utf8")
-		}));
-		req.on("error", () => resolve({
-			tooLarge,
-			text: ""
-		}));
-	});
-}
+/** Loopback request-body cap for /call. Tool arguments are tiny; this only
+* exists so a token-holding (possibly prompt-injected) agy child cannot OOM the
+* host by streaming an unbounded body. The bounded reader itself is shared with
+* the plugin's web routes (see ./read-json-body.ts). */
+const MCP_MAX_BODY_BYTES = 8388608;
 /** Constant-time bearer comparison (the token is a shared secret). */
 function bearerMatches(provided, expected) {
 	const a = Buffer.from(provided, "utf8");
@@ -34764,18 +34792,16 @@ function startMcpBridge(opts) {
 				return;
 			}
 			if (req.method === "POST" && (url === "/call" || url === "/mcp/call")) {
-				const body = await readBody(req, opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+				const body = await readJsonBody(req, { maxBytes: opts.maxBodyBytes ?? MCP_MAX_BODY_BYTES });
 				if (body.tooLarge) {
 					sendJson(res, 413, { error: "request body too large" });
 					return;
 				}
-				let parsed = {};
-				try {
-					parsed = JSON.parse(body.text);
-				} catch {
+				if (body.invalid) {
 					sendJson(res, 400, { error: "invalid JSON" });
 					return;
 				}
+				const parsed = body.value;
 				const svc = opts.tools();
 				if (!svc) {
 					sendJson(res, 503, { error: "tools service unavailable" });
@@ -35493,20 +35519,10 @@ function apply(ctx, entryConfig = {}) {
 			res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
 			res.end(JSON.stringify(body));
 		};
-		const readBody = (req, strict = false) => {
-			const r = req;
-			return new Promise((resolve) => {
-				const chunks = [];
-				r.on?.("data", (c) => chunks.push(c));
-				r.on?.("end", () => {
-					try {
-						const v = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-						resolve(v && typeof v === "object" ? v : {});
-					} catch {
-						resolve(strict ? { __invalidJson: true } : {});
-					}
-				});
-			});
+		const readBody = async (req, strict = false) => {
+			const result = await readJsonBody(req);
+			if (result.invalid || result.tooLarge) return strict ? { __invalidJson: true } : {};
+			return result.value;
 		};
 		const methodOf = (req) => {
 			const m = req.method;

package/docs/SECURITY-NOTES.md

@@ -44,3 +44,15 @@ choice, not a fallback applied by this plugin.
 `/agy doctor` writes its report with redaction: Google auth URLs,
 `4/...` authorization codes, `ya29.*` tokens, and `Bearer` headers are
 stripped before the file hits disk. Still read it before attaching.
+
+## HTTP surfaces and request-body caps
+
+- The plugin's web routes (`/plugins/agy-link/*`) and the experimental loopback
+  MCP bridge (`/call`) share one bounded JSON body reader
+  (`src/host/read-json-body.ts`): bodies are capped (1 MiB for plugin routes,
+  8 MiB for `/call`) and oversized bodies are discarded rather than buffered, so
+  a local client — including a prompt-injected agy child holding the bridge token
+  — cannot exhaust host memory by streaming a huge POST body.
+- The MCP bridge binds to `127.0.0.1` only, requires a per-process random bearer
+  token compared in constant time, enforces `mcpToolAllowlist` at execution time,
+  and never exposes the internal `run_code`/`agy_ask`/`agy_tool` tools.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.77",
+  "version": "0.4.78",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",