mcp-for-i 0.1.13 → 0.2.0

package/dist/controlplane/runtimeService.js

@@ -4,6 +4,7 @@ import os from "os";
 import path from "path";
 import { fileURLToPath } from "url";
 import { getPlatformDescriptor } from "./platform.js";
+import { ControlPlaneError } from "./errors.js";
 import { disableBackgroundService, enableBackgroundService, getServiceStatus } from "./serviceManager.js";
 export class RuntimeService {
     rootDir;
@@ -13,6 +14,7 @@ export class RuntimeService {
         enableService: makeJob("enableService"),
         disableService: makeJob("disableService")
     };
+    pending = new Map();
     constructor(rootDir) {
         this.rootDir = rootDir;
     }
@@ -20,6 +22,7 @@ export class RuntimeService {
         return this.state;
     }
     async getVersions(options) {
+        const source = resolveSkillsSource(options);
         const mode = await this.detectExecutionModeQuiet();
         const checkedAt = new Date().toISOString();
         const mcpInstalled = await this.readLocalPackageVersion(this.rootDir);
@@ -27,8 +30,7 @@ export class RuntimeService {
         const mcpStatus = mcpInstalled && mcpLatest
             ? (mcpInstalled === mcpLatest ? "latest" : "update-available")
             : "unknown";
-        const configuredRepo = sanitizeRepoUrl(options?.repoUrl) || process.env.MCP_FOR_I_SKILLS_REPO || DEFAULT_SKILLS_REPO;
-        const configuredBranch = sanitizeBranch(options?.branch) || process.env.MCP_FOR_I_SKILLS_BRANCH || "main";
+        const { repoUrl: configuredRepo, branch: configuredBranch } = source;
         const skillsDir = path.join(this.rootDir, "skills");
         const skillsGit = path.join(skillsDir, ".git");
         const skills = {
@@ -89,14 +91,14 @@ export class RuntimeService {
         });
     }
     async updateSkills(options) {
+        // Validate before starting the job so bad input is a 400, not a failed job.
+        const { repoUrl, branch } = resolveSkillsSource(options);
         return this.runJob("updateSkills", async (push) => {
-            const repoUrl = sanitizeRepoUrl(options?.repoUrl) || process.env.MCP_FOR_I_SKILLS_REPO || DEFAULT_SKILLS_REPO;
-            const branch = sanitizeBranch(options?.branch) || process.env.MCP_FOR_I_SKILLS_BRANCH || "main";
             const skillsDir = path.join(this.rootDir, "skills");
             const hasSkills = await pathExists(skillsDir);
             push(`Using skills repository: ${repoUrl} (${branch})`);
             if (!hasSkills) {
-                await this.runCommand("git", ["clone", "--depth", "1", "--branch", branch, repoUrl, skillsDir], this.rootDir, push);
+                await this.runCommand("git", ["clone", "--depth", "1", "--branch", branch, "--", repoUrl, skillsDir], this.rootDir, push);
                 return;
             }
             const skillsGit = path.join(skillsDir, ".git");
@@ -104,7 +106,7 @@ export class RuntimeService {
                 const currentRemote = await this.getGitRemoteUrl(skillsDir, push);
                 if (currentRemote && currentRemote !== repoUrl) {
                     push(`Switching skills remote from ${currentRemote} to ${repoUrl}`);
-                    await this.runCommand("git", ["remote", "set-url", "origin", repoUrl], skillsDir, push);
+                    await this.runCommand("git", ["remote", "set-url", "--", "origin", repoUrl], skillsDir, push);
                 }
                 await this.runCommand("git", ["fetch", "origin", branch], skillsDir, push);
                 await this.runCommand("git", ["checkout", branch], skillsDir, push);
@@ -115,7 +117,7 @@ export class RuntimeService {
             push(`Existing skills directory is not a git repository. Backing it up to ${backupDir}`);
             await fs.rename(skillsDir, backupDir);
             try {
-                await this.runCommand("git", ["clone", "--depth", "1", "--branch", branch, repoUrl, skillsDir], this.rootDir, push);
+                await this.runCommand("git", ["clone", "--depth", "1", "--branch", branch, "--", repoUrl, skillsDir], this.rootDir, push);
             }
             catch (error) {
                 push("Clone failed. Restoring previous skills directory.");
@@ -152,6 +154,15 @@ export class RuntimeService {
                 push(`Target: ${status.target}`);
         });
     }
+    /** Resolves when the given job has finished (immediately if it is not running). */
+    async waitForJob(kind) {
+        await this.pending.get(kind);
+        return this.state[kind];
+    }
+    /**
+     * Starts a job in the background and returns it right away with status
+     * "running". Progress is read through getStatus() (GET /api/runtime/status).
+     */
     async runJob(kind, fn) {
         const current = this.state[kind];
         if (current.status === "running") {
@@ -167,19 +178,23 @@ export class RuntimeService {
                 job.output.splice(0, job.output.length - 300);
             }
         };
-        try {
-            await fn(push);
-            job.status = "success";
-        }
-        catch (err) {
-            job.status = "failed";
-            job.error = err?.message || String(err);
-            push(`ERROR: ${job.error}`);
-        }
-        finally {
-            job.finishedAt = new Date().toISOString();
-        }
-        return job;
+        const done = (async () => {
+            try {
+                await fn(push);
+                job.status = "success";
+            }
+            catch (err) {
+                job.status = "failed";
+                job.error = err?.message || String(err);
+                push(`ERROR: ${job.error}`);
+            }
+            finally {
+                job.finishedAt = new Date().toISOString();
+                this.pending.delete(kind);
+            }
+        })();
+        this.pending.set(kind, done);
+        return { ...job, output: [...job.output] };
     }
     runCommand(command, args, cwd, push) {
         return new Promise((resolve, reject) => {
@@ -379,7 +394,7 @@ export class RuntimeService {
     }
     async getRemoteBranchCommitQuiet(repoUrl, branch, short = false) {
         try {
-            const out = await this.runCommandCaptureSilent("git", ["ls-remote", repoUrl, branch], this.rootDir);
+            const out = await this.runCommandCaptureSilent("git", ["ls-remote", "--", repoUrl, branch], this.rootDir);
             const firstLine = out.split(/\r?\n/).find(Boolean);
             if (!firstLine)
                 return undefined;
@@ -453,22 +468,79 @@ async function resolveNpmLaunch() {
     }
     return { mode: "command", path: process.platform === "win32" ? "npm.cmd" : "npm" };
 }
-function sanitizeRepoUrl(value) {
-    if (!value)
+/**
+ * Picks the skills repository and branch (request, then environment, then
+ * defaults) and validates them. Throws a 400 error for unsafe values.
+ */
+export function resolveSkillsSource(options) {
+    const repoUrl = sanitizeRepoUrl(options?.repoUrl)
+        || sanitizeRepoUrl(process.env.MCP_FOR_I_SKILLS_REPO)
+        || DEFAULT_SKILLS_REPO;
+    const branch = sanitizeBranch(options?.branch)
+        || sanitizeBranch(process.env.MCP_FOR_I_SKILLS_BRANCH)
+        || "main";
+    return { repoUrl, branch };
+}
+/**
+ * Accepts only https://, ssh:// and scp-style (user@host:path) git URLs.
+ * Anything that git could read as an option (leading "-") or that uses another
+ * transport (ext::, file://, local paths) is rejected.
+ */
+export function sanitizeRepoUrl(value) {
+    if (typeof value !== "string")
         return undefined;
     const trimmed = value.trim();
     if (!trimmed)
         return undefined;
-    return trimmed;
+    const invalid = () => new ControlPlaneError(400, "repoUrl must be an https://, ssh:// or user@host:path git URL");
+    if (trimmed.length > 2048 || trimmed.startsWith("-") || /[\s\x00-\x1f\x7f]/.test(trimmed)) {
+        throw invalid();
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) {
+        let parsed;
+        try {
+            parsed = new URL(trimmed);
+        }
+        catch {
+            throw invalid();
+        }
+        if (parsed.protocol !== "https:" && parsed.protocol !== "ssh:")
+            throw invalid();
+        if (!parsed.hostname || parsed.hostname.startsWith("-") || parsed.username.startsWith("-"))
+            throw invalid();
+        return trimmed;
+    }
+    // scp-like syntax: git@github.com:owner/repo.git
+    if (/^[A-Za-z0-9._-]+@[A-Za-z0-9][A-Za-z0-9.-]*:[A-Za-z0-9._~/-]+$/.test(trimmed) && !trimmed.includes("::")) {
+        return trimmed;
+    }
+    throw invalid();
 }
-function sanitizeBranch(value) {
-    if (!value)
+/** Validates a branch name using the git check-ref-format rules. */
+export function sanitizeBranch(value) {
+    if (typeof value !== "string")
         return undefined;
     const trimmed = value.trim();
     if (!trimmed)
         return undefined;
+    if (!isSafeBranchName(trimmed)) {
+        throw new ControlPlaneError(400, `Invalid branch name: ${JSON.stringify(trimmed.slice(0, 100))}`);
+    }
     return trimmed;
 }
+function isSafeBranchName(name) {
+    if (name.length > 255)
+        return false;
+    if (name.startsWith("-") || name === "@" || name === "HEAD")
+        return false;
+    if (/[\x00-\x20\x7f~^:?*[\\]/.test(name))
+        return false;
+    if (name.includes("..") || name.includes("@{") || name.includes("//"))
+        return false;
+    if (name.startsWith("/") || name.endsWith("/") || name.endsWith("."))
+        return false;
+    return name.split("/").every(part => part.length > 0 && !part.startsWith(".") && !part.endsWith(".lock"));
+}
 async function safeRename(from, to) {
     try {
         await fs.rename(from, to);

package/dist/controlplane/server.js

@@ -10,46 +10,132 @@ import { ConnectionService } from "./connectionService.js";
 import { RuntimeService } from "./runtimeService.js";
 import { ClientIntegrationService } from "./clientIntegrationService.js";
 import { renderControlPlaneHtml } from "./ui.js";
+import { ControlPlaneError } from "./errors.js";
+import { HEALTH_SERVICE_ID } from "./serverShared.js";
+import { CONTROL_TOKEN_HEADER, ensureControlToken, isAllowedHostHeader, isAllowedOrigin, tokensMatch } from "./auth.js";
+/** Largest accepted request body. Bigger bodies get 413. */
+export const MAX_BODY_BYTES = 1024 * 1024;
 export async function startControlPlaneServer(opts) {
     const host = opts?.host || process.env.MCP_FOR_I_CONTROL_HOST || "127.0.0.1";
-    const port = normalizePort(opts?.port || Number(process.env.MCP_FOR_I_CONTROL_PORT || 3980));
+    const port = typeof opts?.port === "number"
+        ? normalizePort(opts.port, true)
+        : normalizePort(Number(process.env.MCP_FOR_I_CONTROL_PORT || 3980));
     const rootDir = opts?.rootDir || process.env.MCP_FOR_I_ROOT_DIR || getDefaultRootDir();
+    const token = opts?.token || ensureControlToken();
     const store = new ConfigStore();
     const connections = new ConnectionService(store);
     const runtime = new RuntimeService(rootDir);
     const clients = new ClientIntegrationService(rootDir);
+    const guard = { token, port, extraHosts: extraAllowedHosts(host) };
     const server = http.createServer(async (req, res) => {
         try {
-            await routeRequest(req, res, { store, connections, runtime, clients });
+            if (!checkRequest(req, res, guard))
+                return;
+            await routeRequest(req, res, { store, connections, runtime, clients, token });
         }
         catch (err) {
-            sendJson(res, 500, { error: err?.message || String(err) });
+            if (res.headersSent) {
+                res.destroy();
+                return;
+            }
+            const status = err instanceof ControlPlaneError ? err.status : 500;
+            if (status === 413)
+                res.setHeader("Connection", "close");
+            sendJson(res, status, { error: err?.message || String(err) });
         }
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
         server.listen(port, host, () => resolve());
     });
+    guard.port = server.address().port;
+    const closed = new Promise(resolve => server.once("close", () => resolve()));
     return {
         host,
-        port,
+        port: guard.port,
+        token,
+        closed,
         close: () => new Promise((resolve, reject) => {
             server.close(err => (err ? reject(err) : resolve()));
+            server.closeIdleConnections();
         })
     };
 }
+/**
+ * Rejects requests that did not come from the local Web UI or CLI: a wrong Host
+ * header (DNS rebinding), a foreign Origin, a missing token on /api routes,
+ * non-JSON bodies, and bodies over the size limit.
+ */
+function checkRequest(req, res, guard) {
+    if (!isAllowedHostHeader(req.headers.host, guard.port, guard.extraHosts)) {
+        rejectRequest(req, res, 421, "Host not allowed");
+        return false;
+    }
+    const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+    if (!isAllowedOrigin(origin, guard.port, guard.extraHosts) || req.headers["sec-fetch-site"] === "cross-site") {
+        rejectRequest(req, res, 403, "Cross-origin requests are not allowed");
+        return false;
+    }
+    const pathname = (req.url || "/").split("?")[0];
+    if (!pathname.startsWith("/api/"))
+        return true;
+    // /api/health answers without a token so launchers can probe liveness,
+    // but it only returns details when the token is present.
+    const isHealth = pathname === "/api/health" && (req.method === "GET" || req.method === "HEAD");
+    if (!isHealth && !tokensMatch(guard.token, req.headers[CONTROL_TOKEN_HEADER.toLowerCase()])) {
+        rejectRequest(req, res, 401, `Missing or invalid ${CONTROL_TOKEN_HEADER} header`);
+        return false;
+    }
+    const method = req.method || "GET";
+    if (method !== "GET" && method !== "HEAD" && method !== "DELETE") {
+        const contentType = String(req.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+        if (contentType !== "application/json") {
+            rejectRequest(req, res, 415, "Content-Type must be application/json");
+            return false;
+        }
+    }
+    const declared = Number(req.headers["content-length"]);
+    if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        rejectRequest(req, res, 413, `Request body exceeds ${MAX_BODY_BYTES} bytes`);
+        return false;
+    }
+    return true;
+}
+function rejectRequest(req, res, status, error) {
+    // Do not read a rejected body; close the connection once the reply is sent.
+    res.setHeader("Connection", "close");
+    sendJson(res, status, { error });
+    req.resume();
+}
+function extraAllowedHosts(bindHost) {
+    const lower = bindHost.trim().toLowerCase();
+    if (!lower || lower === "0.0.0.0" || lower === "::" || lower === "[::]")
+        return [];
+    return [lower];
+}
 async function routeRequest(req, res, services) {
     const method = req.method || "GET";
     const url = new URL(req.url || "/", "http://127.0.0.1");
     const pathname = url.pathname;
     if (method === "GET" && pathname === "/") {
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(renderControlPlaneHtml());
+        res.writeHead(200, {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store",
+            "X-Frame-Options": "DENY",
+            "Content-Security-Policy": "frame-ancestors 'none'",
+            "Referrer-Policy": "no-referrer",
+            "X-Content-Type-Options": "nosniff"
+        });
+        res.end(renderControlPlaneHtml(services.token));
         return;
     }
     if (method === "GET" && pathname === "/api/health") {
+        if (!tokensMatch(services.token, req.headers[CONTROL_TOKEN_HEADER.toLowerCase()])) {
+            sendJson(res, 200, { ok: true, service: HEALTH_SERVICE_ID });
+            return;
+        }
         const credentialStore = await getCredentialStoreStatus();
-        sendJson(res, 200, { ok: true, keychainAvailable: credentialStore.keychainAvailable, credentialStore });
+        sendJson(res, 200, { ok: true, service: HEALTH_SERVICE_ID, keychainAvailable: credentialStore.keychainAvailable, credentialStore });
         return;
     }
     if (method === "GET" && pathname === "/api/settings") {
@@ -161,6 +247,18 @@ async function routeRequest(req, res, services) {
         sendJson(res, 201, { connection: created });
         return;
     }
+    if (method === "POST" && pathname === "/api/connections/test") {
+        const body = await readJson(req);
+        const result = await services.connections.testDetails(body);
+        sendJson(res, 200, { result });
+        return;
+    }
+    const matchTest = pathname.match(/^\/api\/connections\/([^/]+)\/test$/);
+    if (matchTest && method === "POST") {
+        const result = await services.connections.testSaved(decodeURIComponent(matchTest[1]));
+        sendJson(res, 200, { result });
+        return;
+    }
     const matchConn = pathname.match(/^\/api\/connections\/([^/]+)$/);
     if (matchConn) {
         const name = decodeURIComponent(matchConn[1]);
@@ -227,20 +325,33 @@ function sendNoContent(res) {
 }
 async function readJson(req) {
     const chunks = [];
+    let total = 0;
     for await (const chunk of req) {
-        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buf.length;
+        if (total > MAX_BODY_BYTES) {
+            throw new ControlPlaneError(413, `Request body exceeds ${MAX_BODY_BYTES} bytes`);
+        }
+        chunks.push(buf);
     }
     const raw = Buffer.concat(chunks).toString("utf8");
     if (!raw.trim())
         return {};
+    let parsed;
     try {
-        return JSON.parse(raw);
+        parsed = JSON.parse(raw);
     }
     catch {
-        throw new Error("Invalid JSON body");
+        throw new ControlPlaneError(400, "Invalid JSON body");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ControlPlaneError(400, "JSON body must be an object");
     }
+    return parsed;
 }
-function normalizePort(port) {
+function normalizePort(port, allowEphemeral = false) {
+    if (allowEphemeral && port === 0)
+        return 0;
     if (!Number.isFinite(port) || port <= 0 || port > 65535)
         return 3980;
     return Math.floor(port);

package/dist/controlplane/serverShared.js

@@ -1,16 +1,35 @@
-export function getControlPlaneUrl() {
-    const host = process.env.MCP_FOR_I_CONTROL_HOST || "127.0.0.1";
+import { CONTROL_TOKEN_HEADER, readControlToken } from "./auth.js";
+/** Marker returned by /api/health so callers know they reached this service. */
+export const HEALTH_SERVICE_ID = "mcp-for-i-control";
+export function getControlPlanePort() {
     const portRaw = Number(process.env.MCP_FOR_I_CONTROL_PORT || 3980);
-    const port = Number.isFinite(portRaw) && portRaw > 0 && portRaw <= 65535 ? Math.floor(portRaw) : 3980;
-    return `http://${host}:${port}`;
+    return Number.isFinite(portRaw) && portRaw > 0 && portRaw <= 65535 ? Math.floor(portRaw) : 3980;
+}
+export function getControlPlaneUrl() {
+    const configured = (process.env.MCP_FOR_I_CONTROL_HOST || "").trim();
+    // A wildcard bind address is not a valid Host for the server's checks.
+    const host = !configured || ["0.0.0.0", "::", "[::]"].includes(configured) ? "127.0.0.1" : configured;
+    const urlHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+    return `http://${urlHost}:${getControlPlanePort()}`;
+}
+/** Headers the CLI sends to the control plane (includes the per-install token). */
+export function getControlPlaneAuthHeaders() {
+    const token = readControlToken();
+    return token ? { [CONTROL_TOKEN_HEADER]: token } : {};
 }
 export async function isControlPlaneRunning(baseUrl = getControlPlaneUrl()) {
     try {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 1500);
-        const res = await fetch(`${baseUrl}/api/health`, { signal: controller.signal });
+        const res = await fetch(`${baseUrl}/api/health`, {
+            signal: controller.signal,
+            headers: getControlPlaneAuthHeaders()
+        });
         clearTimeout(timeout);
-        return res.ok;
+        if (!res.ok)
+            return false;
+        const body = await res.json().catch(() => null);
+        return Boolean(body?.ok);
     }
     catch {
         return false;