dsh-db-mcp 0.6.8 → 0.6.9

package/README.md

@@ -310,6 +310,21 @@ driver itself where the engine allows it (`mode=ro` for SQLite,
 `default_transaction_read_only` for PostgreSQL, `SET SESSION TRANSACTION READ ONLY`
 for MySQL).
 
+### What the plugin runs, and with what
+
+- The Python server is started with a fixed interpreter path, a fixed script and a
+  fixed argument list — never through a shell, so no string is ever re-parsed by
+  `cmd.exe` or `/bin/sh`.
+- The child does **not** inherit the host environment. It gets a short allowlist
+  (`PATH`, `TEMP`, `HOME`, `PYTHON*`, and similar) plus the three `DB_MCP_*` flags
+  the plugin sets. Tokens or cloud credentials in the DSH process are not passed
+  down.
+- Connections to PostgreSQL, MySQL and Oracle are opened by that child; only SQLite
+  is read in-process. The raw TCP probe is a fallback used when the child cannot
+  start, and it never sends credentials.
+- Passwords live in `secrets.json` (mode `0600`) and are never returned by any HTTP
+  route; the panel only learns `hasSecret`.
+
 ## Audit log
 
 Every MCP tool call appends one JSON line to `<runtime>/logs/audit.jsonl` (0600):

package/README.zh.md

@@ -209,6 +209,14 @@ node dev/mcp.test.mjs     # 19 项：真实 Python 服务走 stdio，真实 SQLi
 
 Python 服务启动时从环境变量 `DB_MCP_ALLOW_WRITE` 读取全局标记；开关一变，Host 就会重启它。只要引擎支持，只读还会在驱动层再兜一次（SQLite 的 `mode=ro`、PostgreSQL 的 `default_transaction_read_only`、MySQL 的 `SET SESSION TRANSACTION READ ONLY`）。
 
+### 插件会启动什么，以及带着什么
+
+- Python 服务用固定的解释器路径、固定脚本、固定参数启动，**从不经过 shell**，所以任何字符串都不会被 `cmd.exe` 或 `/bin/sh` 再解析一次。
+- 子进程**不继承** Host 的环境变量。它只拿到一张很短的允许清单（`PATH`、`TEMP`、`HOME`、`PYTHON*` 之类）再加上插件自己设置的 `DB_MCP_*`。DSH 进程里的 token、云凭据不会被带下去。
+- PostgreSQL / MySQL / Oracle 都由这个子进程连接，只有 SQLite 是在进程内读的。裸 TCP 探测只是子进程起不来时的兜底，且不发任何凭据。
+- 口令存在 `secrets.json`（`0600`），任何 HTTP 接口都不会返回它；面板只知道 `hasSecret`。
+
+
 ## 审计日志
 
 每次 MCP 工具调用都会向 `<运行时目录>/logs/audit.jsonl`（0600）追加一行 JSON：时间、工具、数据源、耗时、行数、截断到 2000 字符的 SQL，以及失败时的错误。结果行永不记录。文件超过 512 KiB 轮转为 `audit.1.jsonl`，也可以在 `settings.json` 里用 `auditLog: false` 关掉。面板显示最近十几条，时间按**本机时区**换算——文件里存的是 UTC，这样换机器也仍然可比；卡片会把每条时间戳转成浏览者的时区，并标出所用偏移。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-db-mcp",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "description": "DSH database plugin: a data-source management panel plus a Python MCP server that exposes those sources to the agent.",
   "keywords": [
     "dsh",

package/src/host.js

@@ -33,7 +33,7 @@ const { createBridge } = await import(new URL(`./tools.js?v=${GENERATION}`, impo
 
 const API_PREFIX = '/plugins/db-mcp/api'
 const PLUGIN_NAME = 'dsh-db-mcp'
-const PLUGIN_VERSION = '0.6.7'
+const PLUGIN_VERSION = '0.6.9'
 const SCHEMA_VERSION = 1
 const REGISTRY_FILE = 'datasources.json'
 const SECRETS_FILE = 'secrets.json'

package/src/mcp.js

@@ -16,6 +16,50 @@ import { spawn } from 'node:child_process';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const INIT_TIMEOUT_MS = 60_000;
 
+/**
+ * The Python child gets a small, explicit environment instead of a copy of ours.
+ * Spreading `process.env` would hand every token and cloud credential in the
+ * DSH process to a driver stack that only ever needs to find its interpreter.
+ */
+const ENV_ALLOW = [
+  'PATH',
+  'Path',
+  'PATHEXT',
+  'SystemRoot',
+  'SYSTEMROOT',
+  'windir',
+  'ComSpec',
+  'COMSPEC',
+  'TEMP',
+  'TMP',
+  'TMPDIR',
+  'HOME',
+  'USERPROFILE',
+  'HOMEDRIVE',
+  'HOMEPATH',
+  'APPDATA',
+  'LOCALAPPDATA',
+  'PROGRAMDATA',
+  'PROGRAMFILES',
+  'LANG',
+  'LC_ALL',
+  'TZ',
+  'PWD',
+  'PYTHONPATH',
+  'PYTHONHOME',
+  'PYTHONIOENCODING',
+  'VIRTUAL_ENV',
+];
+
+function childEnvironment(extra) {
+  const env = {};
+  for (const key of ENV_ALLOW) {
+    const value = process.env[key];
+    if (typeof value === 'string' && value !== '') env[key] = value;
+  }
+  return Object.assign(env, extra || {});
+}
+
 export class McpError extends Error {
   constructor(message, { code = 'mcp_error', data } = {}) {
     super(message);
@@ -61,7 +105,7 @@ export class McpClient {
     if (this.#child) return this;
     const child = spawn(this.command, this.args, {
       cwd: this.cwd,
-      env: { ...process.env, ...this.env },
+      env: childEnvironment(this.env),
       stdio: ['pipe', 'pipe', 'pipe'],
       windowsHide: true,
     });