kritya 0.8.11-beta → 0.8.13-beta

package/dist/mcp/client.js

@@ -7,6 +7,13 @@ import { McpAuthRequiredError } from "./oauth.js";
 import { missingVars } from "./servers.js";
 import { HttpTransport, StdioTransport } from "./transport.js";
 import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+import { checkToolsShape, serverFingerprint } from "../trust/mcpTrust.js";
+/**
+ * Thrown when a server's live tool shape no longer matches what was recorded
+ * the first time its config was trusted — see checkToolsShape.
+ */
+class McpShapeChangedError extends Error {
+}
 /**
  * Model Context Protocol client with two transports and no SDK dependency
  * (to keep the install lean):
@@ -716,6 +723,9 @@ export async function connectServer(name, cfg, trace) {
         });
         const listed = await conn.initialize();
         const specs = listed.tools;
+        const shape = checkToolsShape(serverFingerprint(cfg), specs, trace?.mcpTrustFile);
+        if (!shape.ok)
+            throw new McpShapeChangedError(name);
         connections.push(conn);
         // Reconnects re-derive names from scratch; releasing the old claims first
         // keeps a server from colliding with its own previous incarnation.
@@ -747,6 +757,19 @@ export async function connectServer(name, cfg, trace) {
             span.setAttribute("kritya.mcp_needs_auth", true);
             span.setStatus("OK");
         }
+        else if (err instanceof McpShapeChangedError) {
+            status.shapeChanged = true;
+            status.error =
+                `its tools no longer match what you approved — run "/mcp trust revoke ${name}" ` +
+                    `and restart kritya to review and re-approve it`;
+            span.setAttribute("kritya.mcp_shape_changed", true);
+            span.setStatus("ERROR", "tool shape changed");
+            trace?.audit?.logTool({
+                tool: "mcp_connect",
+                summary: `server "${name}" tool shape changed since approval`,
+                outcome: "error",
+            });
+        }
         else {
             status.error = err instanceof Error ? err.message : String(err);
             process.stderr.write(`kritya: MCP server "${name}" failed to start: ${status.error}\n`);

package/dist/trust/mcpTrust.js

@@ -41,6 +41,17 @@ export function serverFingerprint(cfg) {
     };
     return crypto.createHash("sha256").update(JSON.stringify(shape)).digest("hex");
 }
+/** Stable identity for a server's live tool list — what it actually does, not where it runs. */
+export function toolsShapeHash(tools) {
+    const shape = tools
+        .map((t) => ({
+        name: t.name,
+        description: t.description ?? "",
+        inputSchema: t.inputSchema ?? null,
+    }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+    return crypto.createHash("sha256").update(JSON.stringify(shape)).digest("hex");
+}
 function loadStore(storeFile) {
     try {
         const parsed = JSON.parse(fs.readFileSync(storeFile, "utf8"));
@@ -109,3 +120,29 @@ export function partitionByTrust(servers, storeFile = MCP_TRUST_FILE) {
     }
     return { trusted, pending };
 }
+/**
+ * Approving a server's *config* (command, url, env keys, ...) only promises
+ * the user reviewed where it runs and what it can reach — not what tools it
+ * actually exposes to the model, which a compromised or malicious server can
+ * change on any connection without touching its declared config at all. This
+ * compares a freshly-connected server's live tool shape (names, descriptions,
+ * input schemas) against what was recorded the first time its config was
+ * trusted.
+ *
+ * There is nothing to compare on that first connection (or after upgrading
+ * from a version that didn't record this), so it's recorded rather than
+ * flagged — otherwise every existing approval would start failing the moment
+ * this check shipped.
+ */
+export function checkToolsShape(fingerprint, tools, storeFile = MCP_TRUST_FILE) {
+    const entries = loadStore(storeFile);
+    const entry = entries.find((e) => e.fingerprint === fingerprint);
+    if (!entry)
+        return { ok: true, recorded: false };
+    const hash = toolsShapeHash(tools);
+    if (!entry.toolsHash) {
+        saveStore(storeFile, entries.map((e) => (e === entry ? { ...e, toolsHash: hash } : e)));
+        return { ok: true, recorded: true };
+    }
+    return { ok: entry.toolsHash === hash, recorded: false };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.11-beta",
+  "version": "0.8.13-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "publishConfig": {
@@ -61,30 +61,30 @@
     "ink": "^7.1.1",
     "ink-text-input": "^6.0.0",
     "jszip": "^3.10.1",
-    "mammoth": "^1.12.1",
-    "openai": "^7.5.0",
+    "mammoth": "^1.12.2",
+    "openai": "^7.8.0",
     "pdf-lib": "^1.17.1",
-    "pdfjs-dist": "^6.1.200",
+    "pdfjs-dist": "^6.3.289",
     "pptxgenjs": "^4.0.1",
     "react": "^19.2.8",
     "string-width": "^8.2.2"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.4.0",
     "@types/react": "^19.2.18",
     "c8": "^12.0.0",
     "electron": "^43.4.1",
     "electron-builder": "^26.15.3",
-    "eslint": "^10.8.1",
+    "eslint": "^10.9.1",
     "globals": "^17.11.0",
     "husky": "^9.1.7",
     "ink-testing-library": "^4.0.0",
-    "lint-staged": "^17.3.0",
+    "lint-staged": "^17.4.1",
     "prettier": "^3.3.0",
     "tsx": "^4.23.9",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.0.0"
+    "typescript-eslint": "^8.68.0"
   },
   "overrides": {
     "brace-expansion": "^5.0.8",