kritya 0.8.21-beta → 0.8.23-beta

package/dist/agent/toolExecutor.js

@@ -1,8 +1,29 @@
 import { classifyDanger } from "../permissions/danger.js";
 import { acknowledgeUnsandboxedFallback, sandboxFallbackWarning } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
+import { redactSecrets } from "../tools/secretScan.js";
 /** How much tool output to hand the UI (it shows a preview and expands on toggle). */
 const PREVIEW_CHARS = 4000;
+/**
+ * Upper bound on a raw tool-call argument payload, checked before JSON.parse.
+ * Individual tools cap their own inputs where it matters (e.g. write_file
+ * content), but this is a backstop against a malformed or adversarial model
+ * response ballooning memory before any tool-specific validation runs.
+ */
+const MAX_ARGS_JSON_CHARS = 2_000_000;
+/**
+ * Backstop cap on what a tool can return to the model, applied after every
+ * tool call regardless of whether that tool already truncates its own
+ * output (most do, via truncateResult/truncateTail — see src/tools/common.ts
+ * — but this catches the ones that don't, or a tool with a bug).
+ */
+const MAX_TOOL_OUTPUT_CHARS = 200_000;
+function truncateToolOutput(output) {
+    if (output.length <= MAX_TOOL_OUTPUT_CHARS)
+        return output;
+    return (output.slice(0, MAX_TOOL_OUTPUT_CHARS) +
+        `\n... [truncated, ${output.length - MAX_TOOL_OUTPUT_CHARS} more characters]`);
+}
 /**
  * A tool outlived its deadline and was abandoned. Carries the tool's name so
  * the message handed back to the model names what to avoid retrying blindly.
@@ -96,6 +117,10 @@ export class ToolExecutor {
         const tool = this.tools.find((t) => t.name === name);
         if (!tool)
             return `Error: unknown tool "${name}"`;
+        if (argsJson.length > MAX_ARGS_JSON_CHARS) {
+            return (`Error: tool arguments for "${name}" are too large ` +
+                `(${argsJson.length} characters, max ${MAX_ARGS_JSON_CHARS}). Use a smaller input.`);
+        }
         let args;
         try {
             args = JSON.parse(argsJson);
@@ -105,7 +130,13 @@ export class ToolExecutor {
         }
         let summary;
         try {
-            summary = tool.summarize(args);
+            // A tool's own summarize() may embed raw values (a fetch_url query
+            // string, a search query, arbitrary text) that happen to contain a
+            // secret the model saw earlier in the conversation. This is the one
+            // chokepoint every tool's summary passes through before it's written
+            // to the audit log and telemetry, so redact here rather than trusting
+            // every individual tool to have already done it.
+            summary = redactSecrets(tool.summarize(args)).redacted;
         }
         catch {
             summary = name;
@@ -291,6 +322,7 @@ export class ToolExecutor {
                 if (post.output.trim())
                     output += `\n[postToolUse hook]: ${post.output.trim()}`;
             }
+            output = truncateToolOutput(output);
             const failed = tool.failed?.(output) ?? false;
             logToolOutcome(failed ? "error" : "ok");
             finishSpan(failed ? "ERROR" : "OK");

package/dist/atomicWrite.js

@@ -59,8 +59,16 @@ export async function writeFileAtomic(filePath, data, options = {}) {
     const target = resolveTarget(filePath);
     const mode = options.mode ?? existingMode(target);
     const tmp = tempPathFor(target);
+    const encoding = options.encoding ?? (typeof data === "string" ? "utf8" : null);
     try {
-        await fsp.writeFile(tmp, data, options.encoding ?? (typeof data === "string" ? "utf8" : null));
+        // Pass `mode` to the create itself rather than chmod-ing afterward: a
+        // separate chmod call leaves a window where the temp file sits at
+        // Node's default (umask-derived, typically world/group-readable) mode
+        // before being narrowed — for a sensitive target (e.g. config.json) that
+        // briefly exposes contents a caller explicitly asked to keep owner-only.
+        // The chmod is kept too, since umask can still trim bits `mode` set on
+        // some platforms.
+        await fsp.writeFile(tmp, data, { encoding, ...(mode !== undefined ? { mode } : {}) });
         if (mode !== undefined)
             await fsp.chmod(tmp, mode);
         await fsp.rename(tmp, target);
@@ -69,7 +77,9 @@ export async function writeFileAtomic(filePath, data, options = {}) {
         await fsp.rm(tmp, { force: true }).catch(() => { });
         if (!isRenameFallback(err))
             throw err;
-        await fsp.writeFile(filePath, data, options.encoding ?? (typeof data === "string" ? "utf8" : null));
+        await fsp.writeFile(filePath, data, { encoding, ...(mode !== undefined ? { mode } : {}) });
+        if (mode !== undefined)
+            await fsp.chmod(filePath, mode);
     }
 }
 export function writeFileAtomicSync(filePath, data, options = {}) {
@@ -101,6 +111,10 @@ export function writeFileAtomicSync(filePath, data, options = {}) {
             ...(options.encoding ? { encoding: options.encoding } : {}),
             ...(mode !== undefined ? { mode } : {}),
         });
+        // Same umask concern as the primary path above: `mode` on writeFileSync
+        // can still be trimmed by umask, so enforce it explicitly.
+        if (mode !== undefined)
+            fs.chmodSync(filePath, mode);
     }
 }
 function isRenameFallback(err) {

package/dist/audit/audit.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnUser } from "../config/debug.js";
 const GENESIS = "0".repeat(64);
 /**
  * Where all audit logs live, across every workspace (not scoped per-project).
@@ -108,7 +108,7 @@ export class AuditLog {
         }
         catch (err) {
             // best-effort
-            debugLog(`AuditLog.write(${this.file})`, err);
+            warnUser(`AuditLog.write(${this.file})`, err);
         }
     }
     ensureDir() {

package/dist/config/config.js

@@ -2,9 +2,105 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { hardenWindowsDir } from "./winAcl.js";
-import { debugLog } from "./debug.js";
+import { debugLog, warnUser } from "./debug.js";
+import { writeFileAtomicSync } from "../atomicWrite.js";
+import { assertJsonWithinLimits } from "./jsonSafety.js";
+/**
+ * Bounds on `mcpServers` entries (from config.json or a workspace's
+ * .mcp.json) — without these, an oversized or malicious server list could
+ * balloon memory, or a single field (a giant command string, thousands of
+ * headers) could be used to abuse whatever eventually consumes it (a shell
+ * spawn, an HTTP client). Real MCP server configs are tiny; these limits are
+ * generous multiples of anything legitimate.
+ */
+const MAX_MCP_SERVERS = 50;
+const MAX_MCP_COMMAND_LENGTH = 4096;
+const MAX_MCP_ARGS = 200;
+const MAX_MCP_ARG_LENGTH = 4096;
+const MAX_MCP_URL_LENGTH = 8192;
+const MAX_MCP_CWD_LENGTH = 4096;
+const MAX_MCP_MAP_ENTRIES = 200;
+const MAX_MCP_MAP_VALUE_LENGTH = 16384;
+function sanitizeMcpStringMap(rec, label) {
+    if (!rec)
+        return undefined;
+    const entries = Object.entries(rec);
+    const out = {};
+    let kept = 0;
+    for (const [k, v] of entries) {
+        if (kept >= MAX_MCP_MAP_ENTRIES) {
+            warnUser(label, new Error(`more than ${MAX_MCP_MAP_ENTRIES} entries; extra entries dropped`));
+            break;
+        }
+        if (typeof v !== "string" || v.length > MAX_MCP_MAP_VALUE_LENGTH) {
+            warnUser(label, new Error(`entry "${k}" exceeds ${MAX_MCP_MAP_VALUE_LENGTH} char limit; dropped`));
+            continue;
+        }
+        out[k] = v;
+        kept++;
+    }
+    return out;
+}
+/** Validates one server entry against the bounds above; returns null to drop the whole server. */
+export function sanitizeMcpServerConfig(name, cfg) {
+    if (typeof cfg.command === "string" && cfg.command.length > MAX_MCP_COMMAND_LENGTH) {
+        warnUser(`mcpServers.${name}.command`, new Error(`exceeds ${MAX_MCP_COMMAND_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    if (typeof cfg.url === "string" && cfg.url.length > MAX_MCP_URL_LENGTH) {
+        warnUser(`mcpServers.${name}.url`, new Error(`exceeds ${MAX_MCP_URL_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    if (typeof cfg.cwd === "string" && cfg.cwd.length > MAX_MCP_CWD_LENGTH) {
+        warnUser(`mcpServers.${name}.cwd`, new Error(`exceeds ${MAX_MCP_CWD_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    let args = cfg.args;
+    if (args) {
+        if (args.length > MAX_MCP_ARGS) {
+            warnUser(`mcpServers.${name}.args`, new Error(`${args.length} args exceeds limit of ${MAX_MCP_ARGS}; extra args dropped`));
+            args = args.slice(0, MAX_MCP_ARGS);
+        }
+        if (args.some((a) => typeof a !== "string" || a.length > MAX_MCP_ARG_LENGTH)) {
+            warnUser(`mcpServers.${name}.args`, new Error(`an argument exceeds ${MAX_MCP_ARG_LENGTH} char limit; server dropped`));
+            return null;
+        }
+    }
+    return {
+        ...cfg,
+        args,
+        env: sanitizeMcpStringMap(cfg.env, `mcpServers.${name}.env`),
+        headers: sanitizeMcpStringMap(cfg.headers, `mcpServers.${name}.headers`),
+    };
+}
+/** Caps server count and validates each entry; oversized/malformed servers are dropped, not truncated. */
+export function sanitizeMcpServersRecord(servers, label = "mcpServers") {
+    if (!servers)
+        return undefined;
+    const names = Object.keys(servers);
+    if (names.length > MAX_MCP_SERVERS) {
+        warnUser(label, new Error(`${names.length} servers exceeds limit of ${MAX_MCP_SERVERS}; extra servers dropped`));
+    }
+    const out = {};
+    let kept = 0;
+    for (const name of names) {
+        if (kept >= MAX_MCP_SERVERS)
+            break;
+        const sanitized = sanitizeMcpServerConfig(name, servers[name]);
+        if (sanitized) {
+            out[name] = sanitized;
+            kept++;
+        }
+    }
+    return out;
+}
+function sanitizeCliConfig(config) {
+    if (!config.mcpServers)
+        return config;
+    return { ...config, mcpServers: sanitizeMcpServersRecord(config.mcpServers) };
+}
 export const CONFIG_DIR = path.join(os.homedir(), ".kritya");
-const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+export const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 export const NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
 /**
  * Built-in OpenAI-compatible providers. Users select one with `provider` in
@@ -101,16 +197,25 @@ export function listProviders(config) {
         .map((name) => ({ name, hasKey: !!resolveProvider(config, name).apiKey }));
 }
 export function loadConfig() {
+    let raw;
     try {
-        const raw = fs.readFileSync(CONFIG_FILE, "utf8");
-        return JSON.parse(raw);
+        raw = fs.readFileSync(CONFIG_FILE, "utf8");
     }
     catch (err) {
-        // A missing file is normal on first run; a malformed one is worth being
-        // able to see when someone reports "my config isn't taking effect".
+        // A missing file is normal on first run.
         debugLog(`loadConfig(${CONFIG_FILE})`, err);
         return {};
     }
+    try {
+        assertJsonWithinLimits(raw, "config.json");
+        return sanitizeCliConfig(JSON.parse(raw));
+    }
+    catch (err) {
+        // Malformed or oversized — worth being able to see when someone reports
+        // "my config isn't taking effect".
+        warnUser(`loadConfig(${CONFIG_FILE})`, err);
+        return {};
+    }
 }
 /**
  * Persist `model` as the default for one provider, leaving every other
@@ -136,15 +241,13 @@ export function saveConfig(patch) {
     // config.json can hold a literal apiKey — keep it readable only by the owner.
     fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     hardenWindowsDir(CONFIG_DIR);
-    fs.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
-    // `mode` on writeFileSync only applies when creating a new file; enforce it
-    // even if config.json pre-existed with looser permissions.
-    try {
-        fs.chmodSync(CONFIG_FILE, 0o600);
-    }
-    catch (err) {
-        debugLog(`saveConfig chmod(${CONFIG_FILE})`, err);
-    }
+    // Atomic (write-to-temp-then-rename) rather than a direct write: config.json
+    // holds API keys, and a crash mid-write would otherwise leave it truncated
+    // and unreadable on next launch. `mode: 0o600` is forced on every save
+    // (rather than only applying on creation, like a plain writeFileSync would),
+    // so a config.json that pre-existed with looser permissions still ends up
+    // owner-only.
+    writeFileAtomicSync(CONFIG_FILE, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
 }
 /**
  * A copy of process.env with kritya-managed secrets removed. Every built-in

package/dist/config/debug.js

@@ -17,3 +17,33 @@ export function debugLog(context, err) {
         // stderr itself failing isn't something debug logging can do anything about
     }
 }
+/**
+ * For best-effort persistence that a user actually needs to know failed
+ * (session/audit/telemetry writes) — unlike debugLog, this always prints a
+ * short one-line warning to stderr, not just under KRITYA_DEBUG. The full
+ * stack trace still only shows up under KRITYA_DEBUG, via the debugLog call
+ * this makes internally.
+ */
+/**
+ * Contexts already warned about via warnUser() this process. Some of these
+ * (a telemetry sink retried every span, an append() called every turn) would
+ * otherwise print the same warning on every single failure — once per
+ * context is enough to tell the user something is wrong without flooding
+ * the terminal.
+ */
+const warnedContexts = new Set();
+export function warnUser(context, err) {
+    if (warnedContexts.has(context)) {
+        debugLog(context, err);
+        return;
+    }
+    warnedContexts.add(context);
+    const message = err instanceof Error ? err.message : String(err);
+    try {
+        process.stderr.write(`[kritya] warning: ${context} failed: ${message}\n`);
+    }
+    catch {
+        // stderr itself failing isn't something this can do anything about
+    }
+    debugLog(context, err);
+}

package/dist/config/jsonSafety.js

@@ -0,0 +1,69 @@
+/**
+ * Shared bounds checks for JSON config files (config.json, .mcp.json) read
+ * from disk. These files are small by nature, so a huge file or pathological
+ * nesting is either corruption or a deliberately hostile input (e.g. a
+ * malicious .mcp.json checked into a repo someone was talked into trusting)
+ * — either way, better to refuse it than to hand an unbounded string or
+ * object graph to JSON.parse and whatever reads the result afterwards.
+ */
+/** Config files this small in practice; anything past this is refused outright. */
+export const MAX_CONFIG_JSON_BYTES = 5 * 1024 * 1024;
+/**
+ * Deep nesting costs stack frames in every recursive consumer downstream
+ * (JSON.stringify on save, object spreads, etc.), not just JSON.parse
+ * itself. Real configs nest a handful of levels deep at most.
+ */
+export const MAX_JSON_DEPTH = 64;
+export class JsonSafetyError extends Error {
+}
+/** Throws if `raw` is larger than `maxBytes` (measured in UTF-8 bytes, not chars). */
+export function assertJsonSizeWithinLimit(raw, maxBytes = MAX_CONFIG_JSON_BYTES, label = "JSON") {
+    if (Buffer.byteLength(raw, "utf8") > maxBytes) {
+        throw new JsonSafetyError(`${label} exceeds ${maxBytes} byte limit`);
+    }
+}
+/**
+ * Throws if the raw JSON text nests objects/arrays deeper than `maxDepth`.
+ * Scans the text directly rather than the parsed tree, so a hostile input is
+ * rejected before JSON.parse ever builds it. String contents (which may
+ * contain unbalanced-looking brace/bracket characters) are skipped rather
+ * than scanned, respecting escapes so an escaped quote doesn't end the
+ * string early.
+ */
+export function assertJsonDepthWithinLimit(raw, maxDepth = MAX_JSON_DEPTH, label = "JSON") {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i++) {
+        const ch = raw[i];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (ch === "\\") {
+                escaped = true;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+        }
+        else if (ch === "{" || ch === "[") {
+            depth++;
+            if (depth > maxDepth) {
+                throw new JsonSafetyError(`${label} nests deeper than ${maxDepth} levels`);
+            }
+        }
+        else if (ch === "}" || ch === "]") {
+            depth--;
+        }
+    }
+}
+/** Runs both the size and depth checks together — the usual entry point before JSON.parse. */
+export function assertJsonWithinLimits(raw, label, maxBytes = MAX_CONFIG_JSON_BYTES, maxDepth = MAX_JSON_DEPTH) {
+    assertJsonSizeWithinLimit(raw, maxBytes, label);
+    assertJsonDepthWithinLimit(raw, maxDepth, label);
+}

package/dist/hooks/hooks.js

@@ -5,6 +5,7 @@ import { CONFIG_DIR, scrubbedShellEnv } from "../config/config.js";
 import { safeCompileRegex } from "../tools/common.js";
 import { NOOP_TRACER } from "../telemetry/tracer.js";
 import { debugLog } from "../config/debug.js";
+import { redactSecrets } from "../tools/secretScan.js";
 const HOOK_TIMEOUT_MS = 30_000;
 export function loadHooks(workspace, trustWorkspace = true) {
     const merged = {};
@@ -85,7 +86,12 @@ export class HookRunner {
                 parent,
                 attributes: { "kritya.hook_command": def.command, "kritya.hook_tool": toolName },
             });
-            const { ok, output } = await execHook(def.command, this.workspace, env);
+            // Hook stdout/stderr is arbitrary command output — it can echo back
+            // whatever the command saw (an env var, a file's contents), so it goes
+            // through the same secret redaction as shell output before it's kept
+            // in the span or handed back to the model.
+            const { ok, output: rawOutput } = await execHook(def.command, this.workspace, env);
+            const output = redactSecrets(rawOutput).redacted;
             if (output)
                 outputs.push(output);
             if (!ok && event === "preToolUse" && def.blocking) {
@@ -107,7 +113,8 @@ export class HookRunner {
                 attributes: { "kritya.hook_command": def.command },
             });
             // stop hooks are best-effort; failures are ignored beyond the span.
-            const { ok, output } = await execHook(def.command, this.workspace, scrubbedShellEnv());
+            const { ok, output: rawOutput } = await execHook(def.command, this.workspace, scrubbedShellEnv());
+            const output = redactSecrets(rawOutput).redacted;
             span.setStatus(ok ? "OK" : "ERROR", ok ? undefined : output.slice(0, 500)).end();
         }
     }

package/dist/index.js

@@ -360,9 +360,16 @@ async function main() {
     // hung collector can't stall shutdown) — cleanup()'s own sessionMeter.flush()
     // is fire-and-forget and would otherwise usually be discarded by the
     // process.exit() that follows it.
+    // SIGINT is included alongside SIGTERM/SIGHUP for the same reason: Ink's
+    // own Ctrl+C handling only fires when it can read a raw keypress from
+    // stdin (which itself falls through to "exit" → cleanup), but a SIGINT
+    // delivered directly to the process — `kill -INT`, a terminal that still
+    // sends a real signal instead of raw-mode bytes — bypasses that path
+    // entirely unless it's handled here too.
     for (const [sig, code] of [
         ["SIGTERM", 143],
         ["SIGHUP", 129],
+        ["SIGINT", 130],
     ]) {
         process.on(sig, () => {
             void (async () => {

package/dist/mcp/client.js

@@ -6,10 +6,11 @@ import { NOOP_TRACER } from "../telemetry/tracer.js";
 import { McpAuthRequiredError } from "./oauth.js";
 import { missingVars } from "./servers.js";
 import { HttpTransport, StdioTransport } from "./transport.js";
-import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+import { assertSafeUrl as assertSafeUrlShared } from "../net/urlSafety.js";
 import { checkToolsShape, serverFingerprint } from "../trust/mcpTrust.js";
 import { probeStdioEra, probeHttpEra } from "./eraDetect.js";
 import { ModernMcpConnection } from "./clientModern.js";
+import { redactSecrets } from "../tools/secretScan.js";
 import { ModernHttpTransport, ReusedProcessTransport, validateToolHeaders, } from "./transportModern.js";
 import { checkSchemaSafety } from "./schemaSafety.js";
 /**
@@ -545,42 +546,17 @@ export function toolAllowed(name, filter) {
         return true;
     return filter.allow.some((p) => matchesPattern(name, p));
 }
-/** Loopback is exempt from the https requirement: there's no network to sniff. */
-function isLoopback(hostname) {
-    const h = hostname.replace(/^\[|\]$/g, "");
-    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
-}
 /**
- * Reject a remote server reachable only over plaintext. `/mcp add` already
- * refuses these, but that guards one entrance: a server hand-written into
- * ~/.kritya/config.json or a repo's .mcp.json never passes through it and
- * would happily POST a bearer token in the clear. This is the choke point all
- * three sources share.
+ * Reject a remote server reachable only over plaintext, or pointed at a
+ * private/internal address. `/mcp add` already refuses these, but that
+ * guards one entrance: a server hand-written into ~/.kritya/config.json or a
+ * repo's .mcp.json never passes through it and would happily POST a bearer
+ * token in the clear. This is the choke point all three sources share —
+ * delegates to the same check used for OAuth discovery/token endpoints
+ * (src/mcp/oauth.ts) so the two can't silently drift apart.
  */
 export function assertSafeUrl(name, url) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        throw new Error(`server "${name}" has an invalid url: ${url}`);
-    }
-    // https alone doesn't mean the traffic (incl. any bearer token in headers)
-    // stays where the user intends — a config pointing at 169.254.169.254 or
-    // another private/internal address would still ship credentials there.
-    // Loopback is exempt: that's this app talking to itself, nothing to leak to.
-    if (!isLoopback(parsed.hostname) && isPrivateOrLoopbackHost(parsed.hostname)) {
-        throw new Error(`server "${name}" points at a private/internal address (${parsed.hostname}) — refusing to connect.`);
-    }
-    if (parsed.protocol === "https:")
-        return parsed;
-    if (parsed.protocol === "http:" && isLoopback(parsed.hostname))
-        return parsed;
-    if (parsed.protocol !== "http:") {
-        throw new Error(`server "${name}" uses unsupported scheme "${parsed.protocol}" — use https://`);
-    }
-    throw new Error(`server "${name}" uses plain http:// (${parsed.host}) — an MCP session carries ` +
-        `your credentials in cleartext over it. Use https:// (localhost is exempt).`);
+    return assertSafeUrlShared(`server "${name}"`, url);
 }
 function makeTransport(name, cfg, workspace) {
     if (cfg.url) {
@@ -878,9 +854,12 @@ export async function connectServer(name, cfg, trace) {
             status.error = err instanceof Error ? err.message : String(err);
             process.stderr.write(`kritya: MCP server "${name}" failed to start: ${status.error}\n`);
             span.setStatus("ERROR", status.error);
+            // status.error comes from the (untrusted) server process's own error
+            // output, which could echo back an env var or header value it was
+            // configured with.
             trace?.audit?.logTool({
                 tool: "mcp_connect",
-                summary: `server "${name}" failed to start: ${status.error}`,
+                summary: redactSecrets(`server "${name}" failed to start: ${status.error}`).redacted,
                 outcome: "error",
             });
         }

package/dist/mcp/eraDetect.js

@@ -44,6 +44,7 @@ import { spawn } from "node:child_process";
 import { planSpawn } from "./spawnWin.js";
 import { minimalEnv } from "./transport.js";
 import { OAuthSession } from "./oauth.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
 /**
  * Probe a stdio server with `server/discover`, per
@@ -160,18 +161,22 @@ export async function probeHttpEra(url, headers, timeoutMs = DEFAULT_HTTP_PROBE_
         }
         return built;
     };
-    const post = async () => fetch(url, {
-        method: "POST",
-        headers: await buildHeaders(),
-        body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: "discover-probe",
-            method: "server/discover",
-            params: { _meta: modernMeta() },
-        }),
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs),
-    });
+    const post = async () => {
+        const init = {
+            method: "POST",
+            headers: await buildHeaders(),
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: "discover-probe",
+                method: "server/discover",
+                params: { _meta: modernMeta() },
+            }),
+            redirect: "manual",
+            signal: AbortSignal.timeout(timeoutMs),
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        return fetch(url, init);
+    };
     let res;
     try {
         res = await post();

package/dist/mcp/oauth.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { VERSION } from "../version.js";
 import { debugLog } from "../config/debug.js";
 import { isExpired, loadAuth, saveAuth } from "./tokens.js";
+import { assertSafeUrl, pinnedDispatcherAllowLoopback, } from "../net/urlSafety.js";
 /**
  * OAuth 2.1 for remote (Streamable HTTP) MCP servers.
  *
@@ -43,8 +44,23 @@ export class McpAuthRequiredError extends Error {
 function ua() {
     return { "user-agent": `kritya/${VERSION}`, accept: "application/json" };
 }
+/**
+ * Fetches JSON from a URL that isn't necessarily one kritya's own config
+ * chose — the .well-known candidates are built from a `serverUrl`/`issuer`,
+ * but a caller can also pass a `resource_metadata` URL taken straight off a
+ * server's WWW-Authenticate header, or an `authorization_servers` entry
+ * from that server's own metadata document. Both are attacker-controlled if
+ * the MCP server is malicious or compromised, so validate here rather than
+ * trust every candidate this module constructs.
+ */
 async function getJson(url, timeoutMs = DISCOVERY_TIMEOUT_MS) {
-    const res = await fetch(url, { headers: ua(), signal: AbortSignal.timeout(timeoutMs) });
+    const safe = assertSafeUrl("OAuth discovery endpoint", url);
+    const init = {
+        headers: ua(),
+        signal: AbortSignal.timeout(timeoutMs),
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(safe, init);
     if (!res.ok)
         throw new Error(`HTTP ${res.status} from ${url}`);
     return res.json();
@@ -156,7 +172,7 @@ export async function registerClient(meta, redirectUri, scope) {
         throw new Error(`authorization server ${meta.issuer} does not support dynamic client registration; ` +
             `register kritya manually and put the client_id in mcp-auth.json`);
     }
-    const res = await fetch(meta.registrationEndpoint, {
+    const registrationInit = {
         method: "POST",
         headers: { ...ua(), "content-type": "application/json" },
         body: JSON.stringify({
@@ -169,7 +185,9 @@ export async function registerClient(meta, redirectUri, scope) {
             ...(scope ? { scope } : {}),
         }),
         signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    });
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(assertSafeUrl("OAuth registration endpoint", meta.registrationEndpoint), registrationInit);
     if (!res.ok) {
         const body = await res.text().catch(() => "");
         throw new Error(`client registration failed: HTTP ${res.status}${body ? ` — ${body.slice(0, 200)}` : ""}`);
@@ -204,12 +222,14 @@ async function postToken(tokenEndpoint, params, clientSecret) {
         const basic = Buffer.from(`${params.client_id}:${clientSecret}`).toString("base64");
         headers.authorization = `Basic ${basic}`;
     }
-    const res = await fetch(tokenEndpoint, {
+    const tokenInit = {
         method: "POST",
         headers,
         body: new URLSearchParams(params).toString(),
         signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    });
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(assertSafeUrl("OAuth token endpoint", tokenEndpoint), tokenInit);
     const doc = (await res.json().catch(() => ({})));
     if (!res.ok || doc.error || !doc.access_token) {
         const detail = doc.error_description ?? doc.error ?? `HTTP ${res.status}`;
@@ -270,7 +290,7 @@ export async function revokeToken(auth) {
     const token = auth.refreshToken ?? auth.accessToken;
     const hint = auth.refreshToken ? "refresh_token" : "access_token";
     try {
-        const res = await fetch(auth.revocationEndpoint, {
+        const revokeInit = {
             method: "POST",
             headers: { ...ua(), "content-type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({
@@ -279,7 +299,9 @@ export async function revokeToken(auth) {
                 client_id: auth.clientId,
             }).toString(),
             signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-        });
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        const res = await fetch(assertSafeUrl("OAuth revocation endpoint", auth.revocationEndpoint), revokeInit);
         return res.ok;
     }
     catch (err) {