ssh-mcp 1.3.0 → 1.5.0

package/README.md

@@ -44,11 +44,13 @@
 - `exec`: Execute a shell command on the remote server
   - **Parameters:**
     - `command` (required): Shell command to execute on the remote SSH server
+    - `description` (optional): Optional description of what this command will do (appended as a comment)
   - **Timeout Configuration:**
 
 - `sudo-exec`: Execute a shell command with sudo elevation
   - **Parameters:**
     - `command` (required): Shell command to execute as root using sudo
+    - `description` (optional): Optional description of what this command will do (appended as a comment)
   - **Notes:**
     - Requires `--sudoPassword` to be set for password-protected sudo
     - Can be disabled by passing the `--disableSudo` flag at startup if sudo access is not needed or not available

package/build/index.js

@@ -130,18 +130,18 @@ export class SSHConnectionManager {
             this.conn.on('ready', async () => {
                 clearTimeout(timeoutId);
                 this.isConnecting = false;
-                console.error('SSH connection established');
-                // If suPassword is provided, attempt to elevate to su shell in background
-                // Do not block connection establishment on elevation (it may take time);
-                // elevation is attempted asynchronously and errors are logged.
-                if (this.sshConfig.suPassword) {
-                    this.ensureElevated().then(() => {
-                        console.error('Successfully elevated to su shell');
-                    }).catch((err) => {
-                        console.error('Failed to elevate to su shell:', err);
-                        // Do not reject connection; just log the error. Subsequent sudo calls
-                        // will either use the su shell if available or provide sudo password.
-                    });
+                // In test mode, don't wait for su elevation during connection setup, as it
+                // may cause JSON-RPC server initialization to hang. Instead, elevation will
+                // be triggered on-demand when a command is executed.
+                // In production, elevation during connection is desirable for robustness.
+                if (this.sshConfig.suPassword && !process.env.SSH_MCP_TEST) {
+                    try {
+                        await this.ensureElevated();
+                    }
+                    catch (err) {
+                        // Do not reject the connection; just log the error. Subsequent commands
+                        // will either use the su shell if available or fall back to normal execution.
+                    }
                 }
                 resolve();
             });
@@ -174,6 +174,31 @@ export class SSHConnectionManager {
     getSudoPassword() {
         return this.sshConfig.sudoPassword;
     }
+    getSuPassword() {
+        return this.sshConfig.suPassword;
+    }
+    async setSuPassword(pwd) {
+        this.sshConfig.suPassword = pwd;
+        if (pwd) {
+            try {
+                await this.ensureElevated();
+            }
+            catch (err) {
+                console.error('setSuPassword: failed to elevate to su shell:', err);
+            }
+        }
+        else {
+            // If clearing suPassword, drop any existing suShell
+            if (this.suShell) {
+                try {
+                    this.suShell.end();
+                }
+                catch (e) { /* ignore */ }
+                this.suShell = null;
+                this.isElevated = false;
+            }
+        }
+    }
     async ensureElevated() {
         if (this.isElevated && this.suShell)
             return;
@@ -183,15 +208,20 @@ export class SSHConnectionManager {
             return this.suPromise;
         this.suPromise = new Promise((resolve, reject) => {
             const conn = this.getConnection();
-            // Open an interactive shell and run `su -` inside it, responding to the password prompt.
-            // Request a PTY so that su/sudo can prompt for a password interactively.
+            // Add a safety timeout so elevation doesn't hang forever
+            const timeoutId = setTimeout(() => {
+                this.suPromise = null;
+                reject(new McpError(ErrorCode.InternalError, 'su elevation timed out'));
+            }, 10000); // 10 second timeout for elevation
             conn.shell({ term: 'xterm', cols: 80, rows: 24 }, (err, stream) => {
                 if (err) {
+                    clearTimeout(timeoutId);
                     this.suPromise = null;
                     reject(new McpError(ErrorCode.InternalError, `Failed to start interactive shell for su: ${err.message}`));
                     return;
                 }
                 let buffer = '';
+                let passwordSent = false;
                 const cleanup = () => {
                     try {
                         stream.removeAllListeners('data');
@@ -199,26 +229,30 @@ export class SSHConnectionManager {
                     catch (e) { /* ignore */ }
                 };
                 const onData = (data) => {
-                    buffer += data.toString();
-                    // Detect password prompt from su
-                    if (/password[: ]*$/i.test(buffer)) {
-                        // Send the su password
+                    const text = data.toString();
+                    buffer += text;
+                    // If we haven't sent the password yet, look for the password prompt
+                    if (!passwordSent && /password[: ]/i.test(buffer)) {
+                        passwordSent = true;
                         stream.write(this.sshConfig.suPassword + '\n');
-                        buffer = '';
-                        return;
+                        // Don't return; keep looking for root prompt
                     }
-                    // Detect common root prompt (ends with #) or explicit root indicator
-                    if (/\n[^\n]*# $/.test(buffer) || /root[@:]/i.test(buffer)) {
-                        // We appear to be elevated; keep the interactive shell as suShell
-                        cleanup();
-                        this.suShell = stream;
-                        this.isElevated = true;
-                        this.suPromise = null;
-                        resolve();
-                        return;
+                    // After password is sent, look for any root indicator
+                    // Look for '#' which indicates root prompt (may be followed by spaces, escape codes, etc)
+                    if (passwordSent) {
+                        if (/#/.test(buffer)) {
+                            clearTimeout(timeoutId);
+                            cleanup();
+                            this.suShell = stream;
+                            this.isElevated = true;
+                            this.suPromise = null;
+                            resolve();
+                            return;
+                        }
                     }
-                    // Detect authentication failure
-                    if (/authentication failure|incorrect password|su: .*failed/i.test(buffer)) {
+                    // Detect authentication failure messages
+                    if (/authentication failure|incorrect password|su: .*failed|su: failure/i.test(buffer)) {
+                        clearTimeout(timeoutId);
                         cleanup();
                         this.suPromise = null;
                         reject(new McpError(ErrorCode.InternalError, `su authentication failed: ${buffer}`));
@@ -227,6 +261,7 @@ export class SSHConnectionManager {
                 };
                 stream.on('data', onData);
                 stream.on('close', () => {
+                    clearTimeout(timeoutId);
                     if (!this.isElevated) {
                         this.suPromise = null;
                         reject(new McpError(ErrorCode.InternalError, 'su shell closed before elevation completed'));
@@ -267,7 +302,7 @@ export class SSHConnectionManager {
 let connectionManager = null;
 const server = new McpServer({
     name: 'SSH MCP Server',
-    version: '1.3.0',
+    version: '1.5.0',
     capabilities: {
         resources: {},
         tools: {},
@@ -275,7 +310,8 @@ const server = new McpServer({
 });
 server.tool("exec", "Execute a shell command on the remote SSH server and return the output.", {
     command: z.string().describe("Shell command to execute on the remote SSH server"),
-}, async ({ command }) => {
+    description: z.string().optional().describe("Optional description of what this command will do"),
+}, async ({ command, description }) => {
     // Sanitize command input
     const sanitizedCommand = sanitizeCommand(command);
     try {
@@ -303,7 +339,27 @@ server.tool("exec", "Execute a shell command on the remote SSH server and return
         }
         // Ensure connection is active (reconnect if needed)
         await connectionManager.ensureConnected();
-        const result = await execSshCommandWithConnection(connectionManager, sanitizedCommand);
+        // If a suPassword was provided, explicitly wait for elevation before executing.
+        // This is critical: ensureElevated is idempotent and will return immediately if
+        // already elevated, so this ensures we have a su shell before we try to use it.
+        if (connectionManager.getSuPassword && connectionManager.getSuPassword()) {
+            try {
+                const elevationPromise = connectionManager.ensureElevated();
+                // Add a short timeout for elevation to complete
+                await Promise.race([
+                    elevationPromise,
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('Elevation timeout')), 5000))
+                ]);
+            }
+            catch (err) {
+                // Log but don't fail; fall back to non-elevated execution if elevation times out
+            }
+        }
+        // Append description as comment if provided
+        const commandWithDescription = description
+            ? `${sanitizedCommand} # ${description.replace(/#/g, '\\#')}`
+            : sanitizedCommand;
+        const result = await execSshCommandWithConnection(connectionManager, commandWithDescription);
         return result;
     }
     catch (err) {
@@ -317,7 +373,8 @@ server.tool("exec", "Execute a shell command on the remote SSH server and return
 if (!DISABLE_SUDO) {
     server.tool("sudo-exec", "Execute a shell command on the remote SSH server using sudo. Will use sudo password if provided, otherwise assumes passwordless sudo.", {
         command: z.string().describe("Shell command to execute with sudo on the remote SSH server"),
-    }, async ({ command }) => {
+        description: z.string().optional().describe("Optional description of what this command will do"),
+    }, async ({ command, description }) => {
         const sanitizedCommand = sanitizeCommand(command);
         try {
             if (!connectionManager) {
@@ -345,17 +402,32 @@ if (!DISABLE_SUDO) {
                 connectionManager = new SSHConnectionManager(sshConfig);
             }
             await connectionManager.ensureConnected();
+            // If suPassword or sudoPassword were provided on this call but the
+            // existing connection manager was created earlier without them,
+            // update the manager's values so the subsequent sudo-exec call uses
+            // the latest passwords.
+            if (SUPASSWORD !== null && SUPASSWORD !== undefined) {
+                await connectionManager.setSuPassword(sanitizePassword(SUPASSWORD));
+            }
+            if (SUDOPASSWORD !== null && SUDOPASSWORD !== undefined) {
+                // update sudoPassword on the manager instance
+                connectionManager.sshConfig = { ...connectionManager.sshConfig, sudoPassword: sanitizePassword(SUDOPASSWORD) };
+            }
             let wrapped;
             const sudoPassword = connectionManager.getSudoPassword();
+            // Append description as comment if provided
+            const commandWithDescription = description
+                ? `${sanitizedCommand} # ${description.replace(/#/g, '\\#')}`
+                : sanitizedCommand;
             if (!sudoPassword) {
                 // No password provided, use -n to fail if sudo requires a password
-                wrapped = `sudo -n sh -c '${sanitizedCommand.replace(/'/g, "'\\''")}'`;
+                wrapped = `sudo -n sh -c '${commandWithDescription.replace(/'/g, "'\\''")}'`;
             }
             else {
                 // Password provided — pipe it into sudo using printf. This avoids complex
                 // PTY/stdin handling on the SSH channel and is simpler and more reliable.
                 const pwdEscaped = sudoPassword.replace(/'/g, "'\\''");
-                wrapped = `printf '%s\\n' '${pwdEscaped}' | sudo -p "" -S sh -c '${sanitizedCommand.replace(/'/g, "'\\''")}'`;
+                wrapped = `printf '%s\\n' '${pwdEscaped}' | sudo -p "" -S sh -c '${commandWithDescription.replace(/'/g, "'\\''")}'`;
             }
             return await execSshCommandWithConnection(connectionManager, wrapped);
         }
@@ -377,40 +449,42 @@ export async function execSshCommandWithConnection(manager, command, stdin) {
         timeoutId = setTimeout(() => {
             if (!isResolved) {
                 isResolved = true;
-                // Try to abort the running command
-                const abortTimeout = setTimeout(() => {
-                    // If abort command itself times out, we'll just reject
-                }, 5000);
-                conn.exec('timeout 3s pkill -f \'' + escapeCommandForShell(command) + '\' 2>/dev/null || true', (err, abortStream) => {
-                    if (abortStream) {
-                        abortStream.on('close', () => {
-                            clearTimeout(abortTimeout);
-                        });
-                    }
-                    else {
-                        clearTimeout(abortTimeout);
-                    }
-                });
                 reject(new McpError(ErrorCode.InternalError, `Command execution timed out after ${DEFAULT_TIMEOUT}ms`));
             }
         }, DEFAULT_TIMEOUT);
-        let execCommand = command;
-        const execFn = shell ?
-            (cb) => {
-                shell.write(execCommand + '\n');
-                cb(null, shell);
-            } :
-            (cb) => {
-                // If we have stdin to send (e.g., sudo -S), request a PTY so sudo can read the
-                // password reliably in environments that require a TTY.
-                if (stdin && stdin.length > 0) {
-                    conn.exec(execCommand, { pty: true }, cb);
-                }
-                else {
-                    conn.exec(execCommand, cb);
+        // If we have an active su shell, use it directly (commands run as root in session)
+        if (shell) {
+            let buffer = '';
+            const dataHandler = (data) => {
+                const text = data.toString();
+                buffer += text;
+                // Wait for root prompt (#) to know command is complete
+                // Match # which indicates root prompt (may be followed by spaces, escape codes, etc)
+                if (/#/.test(buffer)) {
+                    if (!isResolved) {
+                        isResolved = true;
+                        clearTimeout(timeoutId);
+                        // Extract output: remove the command echo and final prompt
+                        const lines = buffer.split('\n');
+                        // First line is often the echoed command; last line is the prompt
+                        let output = lines.slice(1, -1).join('\n');
+                        resolve({
+                            content: [{
+                                    type: 'text',
+                                    text: output + (output ? '\n' : ''),
+                                }],
+                        });
+                    }
+                    shell.removeListener('data', dataHandler);
                 }
             };
-        execFn((err, stream) => {
+            shell.on('data', dataHandler);
+            // Send command immediately; shell is ready after elevation
+            shell.write(command + '\n');
+            return;
+        }
+        // No persistent su shell; use normal exec with optional password piping
+        conn.exec(command, (err, stream) => {
             if (err) {
                 if (!isResolved) {
                     isResolved = true;
@@ -421,31 +495,25 @@ export async function execSshCommandWithConnection(manager, command, stdin) {
             }
             let stdout = '';
             let stderr = '';
-            // Setup data handlers before sending any input
-            stream.on('data', (data) => {
-                stdout += data.toString();
-            });
-            stream.stderr.on('data', (data) => {
-                stderr += data.toString();
-            });
-            // If stdin provided, write it to the stream
-            if (stdin && stdin.length > 0 && !shell) {
+            // If stdin provided (e.g., sudo password), write it
+            if (stdin && stdin.length > 0) {
                 try {
-                    // Write to the exec channel (send to remote stdin)
                     stream.write(stdin);
-                    stream.end(); // End stdin after writing password
                 }
                 catch (e) {
                     console.error('Error writing to stdin:', e);
                 }
             }
-            else {
-                // No stdin, just end the stream (guard in case stream.end is not available)
-                try {
-                    stream.end();
-                }
-                catch (e) { /* ignore */ }
+            try {
+                stream.end();
             }
+            catch (e) { /* ignore */ }
+            stream.on('data', (data) => {
+                stdout += data.toString();
+            });
+            stream.stderr.on('data', (data) => {
+                stderr += data.toString();
+            });
             stream.on('close', (code, signal) => {
                 if (!isResolved) {
                     isResolved = true;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "MCP server exposing SSH control for Linux and Windows systems via Model Context Protocol.",
   "type": "module",
   "bin": {
@@ -58,4 +58,4 @@
   "engines": {
     "node": ">=18"
   }
-}
+}