dsh-agy-link 0.4.78 → 0.4.80

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.80 (2026-10-29)
+
+### English
+
+- **Security(doctor): redact OIDC/JWT id_tokens and more provider secret shapes in `/agy doctor`.**
+  - `redactLine()` already stripped `ya29.*`, `1//0…` refresh tokens, `AIza…` keys, `Bearer` headers, `4/` codes and proxy credentials, but a Google `id_token` (a JWT `header.payload.signature`), `sk-…` provider keys, and `GOCSPX-…` OAuth client secrets passed through verbatim when agy echoed them into the log ring buffer. All three are now redacted; ordinary text is preserved. Adds regression tests.
+
+### 中文
+
+- **安全(doctor)：`/agy doctor` 额外脱敏 OIDC/JWT id_token 及更多密钥形态。**
+  - `redactLine()` 原本已脱敏 `ya29.*`、`1//0…` refresh token、`AIza…` key、`Bearer` 头、`4/` 授权码与代理凭证，但 Google `id_token`（JWT `header.payload.signature`）、`sk-…` 提供方密钥、`GOCSPX-…` OAuth client secret 在 agy 回显进日志环时仍会原样落入报告。现三类均已脱敏，普通文本保持不变。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.79...v0.4.80
+
+## 0.4.79 (2026-10-29)
+
+### English
+
+- **Fix(mcp): never silently drop tools whose names collide after MCP normalization.**
+  - `toMcpName()` maps any non-`[A-Za-z0-9_-]` character to `_`, so distinct DSH tools like `a.b` and `a_b` normalized to the same MCP name and the second was silently removed from `/tools` — hiding a real, possibly allowlisted, tool from the agent. Colliding names are now disambiguated with a stable `__<n>` suffix; `bridge.mjs` still calls back by the exact `_dshName`, so execution is unaffected. Adds a regression test.
+
+### 中文
+
+- **修复(mcp)：名称经 MCP 归一化后撞名的工具不再被静默丢弃。**
+  - `toMcpName()` 会把非 `[A-Za-z0-9_-]` 字符替换成 `_`，于是 `a.b` 与 `a_b` 这类不同工具会归一化成同一个 MCP 名，第二个被从 `/tools` 静默删除，导致一个真实（且可能已加入 allowlist 的）工具对 agent 不可见。现在撞名会加稳定的 `__<n>` 后缀消歧；`bridge.mjs` 仍按精确 `_dshName` 回调，执行不受影响。补充回归测试。
+
+**Full Changelog**: https://github.com/amlyczz/dsh-agy-link/compare/v0.4.78...v0.4.79
+
 ## 0.4.78 (2026-10-29)
 
 ### English

package/dist/index.js

@@ -32399,6 +32399,9 @@ function redactLine(line) {
 	out = out.replace(/Bearer\s+\S+/gi, "Bearer <redacted>");
 	out = out.replace(/\b1\/\/0[A-Za-z0-9._-]{10,}/g, "<oauth-refresh-token-redacted>");
 	out = out.replace(/\bAIza[0-9A-Za-z_-]{30,}\b/g, "<api-key-redacted>");
+	out = out.replace(/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g, "<jwt-redacted>");
+	out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, "<api-key-redacted>");
+	out = out.replace(/\bGOCSPX-[A-Za-z0-9_-]{10,}\b/g, "<api-key-redacted>");
 	out = out.replace(/\b(?:https?|socks[45]):\/\/[^\s/]*:[^\s/@]*@[^\s]+/gi, "<proxy-url-redacted>");
 	return out;
 }
@@ -34773,22 +34776,22 @@ function startMcpBridge(opts) {
 				}
 				const allow = opts.allowlist().split(",").map((s) => s.trim()).filter(Boolean);
 				const allowSet = new Set(allow);
-				const seen = /* @__PURE__ */ new Set();
-				sendJson(res, 200, { tools: svc.schemas().filter((t) => allow.length === 0 || allowSet.has(t.name)).filter((t) => {
-					if (INTERNAL_TOOL_NAMES.has(t.name)) return false;
-					const mapped = toMcpName(t.name);
-					if (seen.has(mapped)) return false;
-					seen.add(mapped);
-					return true;
-				}).map((t) => ({
-					name: toMcpName(t.name),
-					dshName: t.name,
-					description: t.description,
-					inputSchema: {
-						type: "object",
-						...t.parameters
-					}
-				})) });
+				const used = /* @__PURE__ */ new Set();
+				sendJson(res, 200, { tools: svc.schemas().filter((t) => allow.length === 0 || allowSet.has(t.name)).filter((t) => !INTERNAL_TOOL_NAMES.has(t.name)).map((t) => {
+					const base = toMcpName(t.name);
+					let name = base;
+					for (let i = 2; used.has(name); i++) name = base + "__" + i;
+					used.add(name);
+					return {
+						name,
+						dshName: t.name,
+						description: t.description,
+						inputSchema: {
+							type: "object",
+							...t.parameters
+						}
+					};
+				}) });
 				return;
 			}
 			if (req.method === "POST" && (url === "/call" || url === "/mcp/call")) {

package/docs/KNOWN-GAPS.md

@@ -120,6 +120,9 @@ reference-counted slot is the strongest isolation the plugin can provide.
   loopback endpoint also caps request bodies (8 MiB → HTTP 413) and compares the
   bearer token in constant time, so a token-holding but prompt-injected child
   cannot OOM the host with an unbounded body or probe the token via timing.
+  Distinct DSH tool names that normalize to the same MCP name (e.g. `a.b`
+  and `a_b`) are disambiguated with a stable suffix instead of being silently
+  dropped, so every real tool stays reachable.
   Every bridged call is audit-logged as `mcp call <tool> [<outcome>] <ms>` with
   the caller class and the failure text (never the arguments), so a failed run
   is visible in journald instead of only in transcripts.

package/docs/SECURITY-NOTES.md

@@ -42,8 +42,10 @@ choice, not a fallback applied by this plugin.
 ## Report hygiene
 
 `/agy doctor` writes its report with redaction: Google auth URLs,
-`4/...` authorization codes, `ya29.*` tokens, and `Bearer` headers are
-stripped before the file hits disk. Still read it before attaching.
+`4/...` authorization codes, `ya29.*` access tokens, `1//0…` refresh tokens,
+OIDC/JWT `id_token`s, `AIza…`/`sk-…`/`GOCSPX-…` API keys, credentialed proxy
+URLs, and `Bearer` headers are stripped before the file hits disk. Still read it
+before attaching.
 
 ## HTTP surfaces and request-body caps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agy-link",
-  "version": "0.4.78",
+  "version": "0.4.80",
   "description": "Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.",
   "type": "module",
   "license": "MIT",