dsh-agy-link 0.4.77 → 0.4.79

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.79 (2026-10-29)
+
+### English
+
+- **Fix(mcp): never silently drop tools whose names collide after MCP normalization.**
+  - `toMcpName()` maps any non-`[A-Za-z0-9_-]` character to `_`, so distinct DSH tools like `a.b` and `a_b` normalized to the same MCP name and the second was silently removed from `/tools` — hiding a real, possibly allowlisted, tool from the agent. Colliding names are now disambiguated with a stable `__<n>` suffix; `bridge.mjs` still calls back by the exact `_dshName`, so execution is unaffected. Adds a regression test.
+
+### 中文
+
+- **修复(mcp)：名称经 MCP 归一化后撞名的工具不再被静默丢弃。**
+  - `toMcpName()` 会把非 `[A-Za-z0-9_-]` 字符替换成 `_`，于是 `a.b` 与 `a_b` 这类不同工具会归一化成同一个 MCP 名，第二个被从 `/tools` 静默删除，导致一个真实（且可能已加入 allowlist 的）工具对 agent 不可见。现在撞名会加稳定的 `__<n>` 后缀消歧；`bridge.mjs` 仍按精确 `_dshName` 回调，执行不受影响。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.78...v0.4.79
+
+## 0.4.78 (2026-10-29)
+
+### English
+
+- **Refactor(mcp/http): one bounded JSON body reader for every HTTP surface.**
+  - Extracted `src/host/read-json-body.ts` and routed both the MCP bridge `/call` and all `/plugins/agy-link/*` web routes through it. Plugin payloads are tiny config JSON; the old unbounded buffer let any local client (including a prompt-injected agy child holding the bridge token) exhaust host memory by streaming a huge POST body. Bodies are now capped (1 MiB for plugin routes, 8 MiB for `/call`) and oversized ones are discarded. Adds focused unit tests for the reader (valid/malformed/array/oversized/stream-error).
+
+### 中文
+
+- **重构(mcp/http)：所有 HTTP 面共用同一个有界 JSON body 读取器。**
+  - 抽出 `src/host/read-json-body.ts`，MCP 桥接 `/call` 与全部 `/plugins/agy-link/*` Web 路由统一走它。插件请求体都是很小的配置 JSON，此前的无界缓冲会让任意本地客户端（包括持有桥接 token、被提示词注入的 agy 子进程）用超大 POST body 打爆宿主内存。现在缓冲有上限（插件路由 1 MiB、`/call` 8 MiB），超限直接丢弃。为该读取器补充了针对性单测（正常/非法/数组/超限/流错误）。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.77...v0.4.78
+
 ## 0.4.77 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -34639,6 +34639,57 @@ var WarmupService = class {
 		return this.warmupAllAccounts({ force: false });
 	}
 };
+function readJsonBody(req, opts = {}) {
+	const maxBytes = opts.maxBytes ?? 1048576;
+	const emitter = req;
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let tooLarge = false;
+		const done = (result) => resolve(result);
+		emitter.on?.("data", (chunk) => {
+			const buf = chunk ?? Buffer.alloc(0);
+			size += buf.length;
+			if (size > maxBytes) {
+				tooLarge = true;
+				chunks.length = 0;
+				return;
+			}
+			chunks.push(buf);
+		});
+		emitter.on?.("end", () => {
+			if (tooLarge) return done({
+				value: {},
+				tooLarge: true,
+				invalid: false
+			});
+			try {
+				const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+				if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return done({
+					value: parsed,
+					tooLarge: false,
+					invalid: false
+				});
+				return done({
+					value: {},
+					tooLarge: false,
+					invalid: true
+				});
+			} catch {
+				return done({
+					value: {},
+					tooLarge: false,
+					invalid: true
+				});
+			}
+		});
+		emitter.on?.("error", () => done({
+			value: {},
+			tooLarge: false,
+			invalid: true
+		}));
+	});
+}
 //#endregion
 //#region src/host/mcp-bridge.ts
 const MCP_SERVER_KEY = "dsh-tools";
@@ -34660,34 +34711,11 @@ const INTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set([
 function toMcpName(name) {
 	return name.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
-/** Loopback request-body cap. Tool arguments are tiny; this only exists so a
-* token-holding (possibly prompt-injected) agy child cannot OOM the host by
-* streaming an unbounded body at /call. */
-const DEFAULT_MAX_BODY_BYTES = 8388608;
-function readBody(req, maxBytes) {
-	return new Promise((resolve) => {
-		const chunks = [];
-		let size = 0;
-		let tooLarge = false;
-		req.on("data", (c) => {
-			size += c.length;
-			if (size > maxBytes) {
-				tooLarge = true;
-				chunks.length = 0;
-				return;
-			}
-			chunks.push(c);
-		});
-		req.on("end", () => resolve({
-			tooLarge,
-			text: tooLarge ? "" : Buffer.concat(chunks).toString("utf8")
-		}));
-		req.on("error", () => resolve({
-			tooLarge,
-			text: ""
-		}));
-	});
-}
+/** Loopback request-body cap for /call. Tool arguments are tiny; this only
+* exists so a token-holding (possibly prompt-injected) agy child cannot OOM the
+* host by streaming an unbounded body. The bounded reader itself is shared with
+* the plugin's web routes (see ./read-json-body.ts). */
+const MCP_MAX_BODY_BYTES = 8388608;
 /** Constant-time bearer comparison (the token is a shared secret). */
 function bearerMatches(provided, expected) {
 	const a = Buffer.from(provided, "utf8");
@@ -34745,37 +34773,35 @@ function startMcpBridge(opts) {
 				}
 				const allow = opts.allowlist().split(",").map((s) => s.trim()).filter(Boolean);
 				const allowSet = new Set(allow);
-				const seen = /* @__PURE__ */ new Set();
-				sendJson(res, 200, { tools: svc.schemas().filter((t) => allow.length === 0 || allowSet.has(t.name)).filter((t) => {
-					if (INTERNAL_TOOL_NAMES.has(t.name)) return false;
-					const mapped = toMcpName(t.name);
-					if (seen.has(mapped)) return false;
-					seen.add(mapped);
-					return true;
-				}).map((t) => ({
-					name: toMcpName(t.name),
-					dshName: t.name,
-					description: t.description,
-					inputSchema: {
-						type: "object",
-						...t.parameters
-					}
-				})) });
+				const used = /* @__PURE__ */ new Set();
+				sendJson(res, 200, { tools: svc.schemas().filter((t) => allow.length === 0 || allowSet.has(t.name)).filter((t) => !INTERNAL_TOOL_NAMES.has(t.name)).map((t) => {
+					const base = toMcpName(t.name);
+					let name = base;
+					for (let i = 2; used.has(name); i++) name = base + "__" + i;
+					used.add(name);
+					return {
+						name,
+						dshName: t.name,
+						description: t.description,
+						inputSchema: {
+							type: "object",
+							...t.parameters
+						}
+					};
+				}) });
 				return;
 			}
 			if (req.method === "POST" && (url === "/call" || url === "/mcp/call")) {
-				const body = await readBody(req, opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+				const body = await readJsonBody(req, { maxBytes: opts.maxBodyBytes ?? MCP_MAX_BODY_BYTES });
 				if (body.tooLarge) {
 					sendJson(res, 413, { error: "request body too large" });
 					return;
 				}
-				let parsed = {};
-				try {
-					parsed = JSON.parse(body.text);
-				} catch {
+				if (body.invalid) {
 					sendJson(res, 400, { error: "invalid JSON" });
 					return;
 				}
+				const parsed = body.value;
 				const svc = opts.tools();
 				if (!svc) {
 					sendJson(res, 503, { error: "tools service unavailable" });
@@ -35493,20 +35519,10 @@ function apply(ctx, entryConfig = {}) {
 			res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
 			res.end(JSON.stringify(body));
 		};
-		const readBody = (req, strict = false) => {
-			const r = req;
-			return new Promise((resolve) => {
-				const chunks = [];
-				r.on?.("data", (c) => chunks.push(c));
-				r.on?.("end", () => {
-					try {
-						const v = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-						resolve(v && typeof v === "object" ? v : {});
-					} catch {
-						resolve(strict ? { __invalidJson: true } : {});
-					}
-				});
-			});
+		const readBody = async (req, strict = false) => {
+			const result = await readJsonBody(req);
+			if (result.invalid || result.tooLarge) return strict ? { __invalidJson: true } : {};
+			return result.value;
 		};
 		const methodOf = (req) => {
 			const m = req.method;

package/docs/KNOWN-GAPS.md

@@ -120,6 +120,9 @@ reference-counted slot is the strongest isolation the plugin can provide.
   loopback endpoint also caps request bodies (8 MiB → HTTP 413) and compares the
   bearer token in constant time, so a token-holding but prompt-injected child
   cannot OOM the host with an unbounded body or probe the token via timing.
+  Distinct DSH tool names that normalize to the same MCP name (e.g. `a.b`
+  and `a_b`) are disambiguated with a stable suffix instead of being silently
+  dropped, so every real tool stays reachable.
   Every bridged call is audit-logged as `mcp call <tool> [<outcome>] <ms>` with
   the caller class and the failure text (never the arguments), so a failed run
   is visible in journald instead of only in transcripts.

package/docs/SECURITY-NOTES.md

@@ -44,3 +44,15 @@ choice, not a fallback applied by this plugin.
 `/agy doctor` writes its report with redaction: Google auth URLs,
 `4/...` authorization codes, `ya29.*` tokens, and `Bearer` headers are
 stripped before the file hits disk. Still read it before attaching.
+
+## HTTP surfaces and request-body caps
+
+- The plugin's web routes (`/plugins/agy-link/*`) and the experimental loopback
+  MCP bridge (`/call`) share one bounded JSON body reader
+  (`src/host/read-json-body.ts`): bodies are capped (1 MiB for plugin routes,
+  8 MiB for `/call`) and oversized bodies are discarded rather than buffered, so
+  a local client — including a prompt-injected agy child holding the bridge token
+  — cannot exhaust host memory by streaming a huge POST body.
+- The MCP bridge binds to `127.0.0.1` only, requires a per-process random bearer
+  token compared in constant time, enforces `mcpToolAllowlist` at execution time,
+  and never exposes the internal `run_code`/`agy_ask`/`agy_tool` tools.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.77",
+  "version": "0.4.79",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",