mcp-server-kubernetes 4.0.5 → 4.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,6 +1,6 @@
1
1
  export declare const serverConfig: {
2
2
  readonly name: "kubernetes";
3
- readonly version: "4.0.5";
3
+ readonly version: "4.0.6";
4
4
  readonly capabilities: {
5
5
  readonly resources: {};
6
6
  readonly tools: {};
@@ -1,6 +1,6 @@
1
1
  export const serverConfig = {
2
2
  name: "kubernetes",
3
- version: "4.0.5",
3
+ version: "4.0.6",
4
4
  capabilities: {
5
5
  resources: {},
6
6
  tools: {},
@@ -71,14 +71,35 @@ function normalizeFlagName(raw) {
71
71
  name = name.slice(0, eq);
72
72
  return name.toLowerCase();
73
73
  }
74
+ // Extract the short-flag letter from a single-dash token, or null if the token
75
+ // is not a single-dash short flag. pflag lets a short flag carry its value
76
+ // attached with no separator ("-shttp://x" == "--server http://x"), so the
77
+ // letter that matters is always the first character after the dash; the rest of
78
+ // the token is the attached value (or a boolean-flag cluster). Long "--" flags
79
+ // never attach a value without "=", so normalizeFlagName already handles them.
80
+ function shortFlagLetter(raw) {
81
+ if (!raw.startsWith("-") || raw.startsWith("--"))
82
+ return null;
83
+ const body = raw.slice(1);
84
+ if (body.length === 0)
85
+ return null;
86
+ return body[0].toLowerCase();
87
+ }
74
88
  function isDangerousFlagName(rawName, fromArgs) {
75
89
  const name = normalizeFlagName(rawName);
76
90
  if (DANGEROUS_FLAGS.has(name))
77
91
  return true;
78
92
  // Short aliases (-s) are only meaningful when they appear as a CLI token,
79
- // not as a key in the `flags` object.
80
- if (fromArgs && SHORT_ALIASES.has(name))
81
- return true;
93
+ // not as a key in the `flags` object. Match both the bare/split forms
94
+ // (normalizeFlagName -> "s") and the attached form "-sURL" (whose first
95
+ // post-dash character is the flag pflag actually parses).
96
+ if (fromArgs) {
97
+ if (SHORT_ALIASES.has(name))
98
+ return true;
99
+ const short = shortFlagLetter(rawName);
100
+ if (short !== null && SHORT_ALIASES.has(short))
101
+ return true;
102
+ }
82
103
  return false;
83
104
  }
84
105
  function reject(flag) {
@@ -139,6 +160,11 @@ export function assertSafeArgv(args) {
139
160
  const name = normalizeFlagName(tok);
140
161
  if (ARGV_DANGEROUS_FLAGS.has(name) || SHORT_ALIASES.has(name))
141
162
  reject(tok);
163
+ // Attached short-flag form ("-sURL"): match the first post-dash character,
164
+ // which is the flag pflag parses regardless of the trailing value.
165
+ const short = shortFlagLetter(tok);
166
+ if (short !== null && SHORT_ALIASES.has(short))
167
+ reject(tok);
142
168
  }
143
169
  }
144
170
  /**
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "mcp-server-kubernetes",
3
- "version": "4.0.5",
3
+ "version": "4.0.6",
4
4
  "description": "MCP server for interacting with Kubernetes clusters via kubectl",
5
5
  "license": "MIT",
6
6
  "type": "module",