ssh-mcp 1.4.0 → 2.0.0

package/build/observability/tracer.js

@@ -0,0 +1,27 @@
+import { trace } from '@opentelemetry/api';
+let initialized = false;
+const tracer = trace.getTracer('ssh-mcp');
+export { tracer };
+export async function initTracing(endpoint, serviceName) {
+    if (initialized)
+        return;
+    initialized = true;
+    try {
+        const { NodeSDK } = await import('@opentelemetry/sdk-node');
+        const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http');
+        const { resourceFromAttributes } = await import('@opentelemetry/resources');
+        const { ATTR_SERVICE_NAME } = await import('@opentelemetry/semantic-conventions');
+        const exporter = new OTLPTraceExporter({ url: `${endpoint}/v1/traces` });
+        const sdk = new NodeSDK({
+            resource: resourceFromAttributes({
+                [ATTR_SERVICE_NAME]: serviceName,
+            }),
+            traceExporter: exporter,
+        });
+        await sdk.start();
+        console.error(`OpenTelemetry tracing enabled: ${endpoint} (service: ${serviceName})`);
+    }
+    catch (err) {
+        console.error('Failed to initialize OpenTelemetry:', err);
+    }
+}

package/build/policy/classifier.js

@@ -0,0 +1,99 @@
+const READ_ONLY_ALLOWLIST = new Set([
+    'ls', 'cat', 'grep', 'find', 'stat', 'df', 'du', 'head', 'tail', 'wc',
+    'ps', 'uname', 'uptime', 'hostname', 'id', 'who', 'whoami', 'date',
+    'env', 'printenv', 'pwd', 'echo', 'printf', 'test', 'true', 'false',
+    'which', 'whereis', 'file', 'readlink', 'realpath', 'basename', 'dirname',
+    'seq', 'sort', 'uniq', 'cut', 'tr', 'diff', 'comm',
+    'systemctl status', 'journalctl', 'docker ps', 'docker logs', 'docker inspect',
+    'docker stats', 'docker images', 'free', 'top', 'htop', 'iostat', 'vmstat',
+    'netstat', 'ss', 'ifconfig', 'ip addr', 'ip route', 'arp', 'dig', 'nslookup',
+    'host', 'ping', 'traceroute', 'git status', 'git log',
+    'git diff', 'git branch', 'git show', 'git remote',
+]);
+// Deliberately NOT read-only: `curl` and `wget` fetch arbitrary URLs (SSRF to
+// cloud metadata / internal services), post local files to a remote host
+// (`curl -d @/etc/passwd`), and write remote files (`curl -o`, `wget -O`) —
+// none of which need a shell metacharacter to escape the classifier. They fall
+// through to the `safe` class, so run-command can still use them under policy.
+//
+// Residual risk kept on purpose: dig/nslookup/host/ping/traceroute can leak
+// small amounts of data through DNS/ICMP queries. They cannot modify the host,
+// so they stay read-only; tighten them via profile policy if egress matters.
+/**
+ * Commands that are never allowed, whatever the role or approval policy.
+ *
+ * This is the policy engine's denylist — the single definition of it. The
+ * engine used to keep a parallel copy as regex *strings*, which had already
+ * drifted (it was missing the fork bomb and the recursive chown, and its `rm`
+ * pattern was narrower). Anything here is also destructive for classification
+ * purposes; see DESTRUCTIVE_DENYLIST below.
+ */
+const FORBIDDEN_PATTERNS = [
+    /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
+    /mkfs\./,
+    /dd\s+.*\bof=\/dev\//,
+    />\s*\/dev\/sd/,
+    /\bshutdown\b/,
+    /\breboot\b/,
+    /\bhalt\b/,
+    /\bpoweroff\b/,
+    /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
+    /curl\s+.*\|\s*(sh|bash|zsh)/,
+    /wget\s+.*\|\s*(sh|bash|zsh)/,
+    /\beval\b/,
+    />\s*\/etc\/cron/,
+    />\s*\/etc\/systemd/,
+    />\s*~\/.ssh\/authorized_keys/,
+    /\biptables\s+-F\b/,
+    /\bchmod\s+-R\s+777\s+\//,
+    /\bchown\s+-R\s+.*\s+\/\s*$/,
+];
+/**
+ * Commands that are destructive but legitimate under approval — e.g.
+ * `rm -rf /tmp/build`, which must NOT be confused with `rm -rf /`.
+ */
+const DESTRUCTIVE_PATTERNS = [
+    /rm\s+-rf?\s+\//,
+];
+/** Everything that classifies as destructive: forbidden commands included. */
+const DESTRUCTIVE_DENYLIST = [...FORBIDDEN_PATTERNS, ...DESTRUCTIVE_PATTERNS];
+const PRIVILEGED_INDICATORS = [
+    /^\s*sudo\b/,
+    /^\s*su\b/,
+    /^\s*doas\b/,
+    /^\s*pkexec\b/,
+];
+export function extractBinary(command) {
+    let cmd = command.trim();
+    for (const prefix of PRIVILEGED_INDICATORS) {
+        cmd = cmd.replace(prefix, '').trim();
+    }
+    if (cmd.startsWith('-c ')) {
+        cmd = cmd.slice(3).trim();
+    }
+    const parts = cmd.split(/\s+/);
+    return parts[0] || '';
+}
+export function classifyCommand(command) {
+    const trimmed = command.trim();
+    const binary = extractBinary(trimmed);
+    const fullCommand = trimmed;
+    const isPrivileged = PRIVILEGED_INDICATORS.some((re) => re.test(trimmed));
+    if (isPrivileged) {
+        return { binary, fullCommand, class: 'privileged' };
+    }
+    for (const pattern of DESTRUCTIVE_DENYLIST) {
+        if (pattern.test(trimmed)) {
+            return { binary, fullCommand, class: 'destructive' };
+        }
+    }
+    const twoWordPrefix = fullCommand.split(/\s+/).slice(0, 2).join(' ');
+    if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)) {
+        if (/[>;|]/.test(trimmed)) {
+            return { binary, fullCommand, class: 'safe' };
+        }
+        return { binary, fullCommand, class: 'read-only' };
+    }
+    return { binary, fullCommand, class: 'safe' };
+}
+export { READ_ONLY_ALLOWLIST, DESTRUCTIVE_DENYLIST, FORBIDDEN_PATTERNS };

package/build/policy/engine.js

@@ -0,0 +1,205 @@
+import { classifyCommand, FORBIDDEN_PATTERNS } from './classifier.js';
+/** Tiers, most restrictive first. Unknown/unset tiers resolve to the first. */
+const HOST_GROUPS = ['prod', 'staging', 'dev'];
+export const DEFAULT_RULES = {
+    roleBindings: {
+        viewer: {
+            prod: ['read-only'],
+            staging: ['read-only'],
+            dev: ['read-only', 'safe'],
+        },
+        operator: {
+            prod: ['read-only', 'safe'],
+            staging: ['read-only', 'safe', 'destructive'],
+            dev: ['read-only', 'safe', 'destructive'],
+        },
+        admin: {
+            prod: ['read-only', 'safe', 'destructive'],
+            staging: ['read-only', 'safe', 'destructive', 'privileged'],
+            dev: ['read-only', 'safe', 'destructive', 'privileged'],
+        },
+    },
+};
+export class PolicyEngine {
+    rules;
+    opaUrl = null;
+    /** Rate-limits the fail-open warning so one outage can't flood stderr. */
+    lastOpaWarning = 0;
+    /** Canonical patterns plus the operator's, compiled once at construction. */
+    denyPatterns;
+    constructor(rules = DEFAULT_RULES) {
+        this.rules = rules;
+        // Compile eagerly: a deny rule that silently degrades (the old code fell
+        // back to substring-matching the command against the regex *source*) is
+        // worse than a startup failure, because nothing surfaces the degradation.
+        const userPatterns = (rules.denylist ?? []).map((pattern) => {
+            try {
+                return new RegExp(pattern);
+            }
+            catch (err) {
+                throw new Error(`Invalid denylist pattern ${JSON.stringify(pattern)}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        });
+        this.denyPatterns = [...FORBIDDEN_PATTERNS, ...userPatterns];
+    }
+    setOpaUrl(url) {
+        this.opaUrl = url;
+    }
+    evaluate(command, profile, _toolName) {
+        const parsed = classifyCommand(command);
+        const allowedClasses = this.getAllowedClasses(profile);
+        const classAllowed = allowedClasses.includes(parsed.class);
+        if (this.matchesDenylist(command)) {
+            return {
+                decision: 'deny',
+                commandClass: parsed.class,
+                binary: parsed.binary,
+                ruleId: 'denylist',
+                reason: 'Command matches denylist pattern',
+            };
+        }
+        const needsApproval = parsed.class === 'destructive' || parsed.class === 'privileged';
+        const approvalRequired = this.requiresApproval(profile, needsApproval);
+        if (!classAllowed) {
+            return {
+                decision: 'deny',
+                commandClass: parsed.class,
+                binary: parsed.binary,
+                ruleId: 'role-binding',
+                reason: `Role "${profile.role}" cannot run "${parsed.class}" commands`,
+            };
+        }
+        if (approvalRequired) {
+            // approvalPolicy "deny" rejects outright instead of prompting — otherwise
+            // it would behave exactly like ask-destructive and never deny anything.
+            if (profile.approvalPolicy === 'deny') {
+                return {
+                    decision: 'deny',
+                    commandClass: parsed.class,
+                    binary: parsed.binary,
+                    ruleId: 'approval-policy',
+                    reason: `Profile "${profile.name}" denies ${parsed.class} commands (approvalPolicy = "deny")`,
+                };
+            }
+            return {
+                decision: 'require-approval',
+                commandClass: parsed.class,
+                binary: parsed.binary,
+                ruleId: 'approval-policy',
+                reason: `Profile "${profile.name}" requires approval for ${parsed.class} commands`,
+            };
+        }
+        return {
+            decision: 'allow',
+            commandClass: parsed.class,
+            binary: parsed.binary,
+            ruleId: 'default',
+        };
+    }
+    async evaluateWithOpa(command, profile, toolName) {
+        const local = this.evaluate(command, profile, toolName);
+        if (local.decision === 'deny') {
+            return local;
+        }
+        if (!this.opaUrl) {
+            return local;
+        }
+        try {
+            const parsed = classifyCommand(command);
+            const input = {
+                subject: { role: profile.role, profile: profile.name },
+                action: { tool: toolName, commandClass: parsed.class },
+                resource: { command: parsed.fullCommand, binary: parsed.binary, host: profile.host },
+                context: { readOnly: profile.readOnly },
+            };
+            const resp = await fetch(`${this.opaUrl}/v1/data/ssh/mcp/allow`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ input }),
+            });
+            if (!resp.ok) {
+                this.warnOpaUnavailable(`HTTP ${resp.status} from ${this.opaUrl}`);
+                return local;
+            }
+            const data = await resp.json();
+            if (data.result === false) {
+                return {
+                    decision: 'deny',
+                    commandClass: parsed.class,
+                    binary: parsed.binary,
+                    ruleId: 'opa',
+                    reason: 'Denied by OPA policy',
+                };
+            }
+        }
+        catch (err) {
+            this.warnOpaUnavailable(err instanceof Error ? err.message : String(err));
+        }
+        return local;
+    }
+    /**
+     * OPA is an *additional* deny layer, so an outage falls back to the local
+     * decision rather than blocking all work. That is a deliberate trade-off, but
+     * it must be loud: an operator who deployed OPA as a hard authorization gate
+     * would otherwise have no signal that the gate is down while commands it
+     * would have denied keep running.
+     */
+    warnOpaUnavailable(cause) {
+        const now = Date.now();
+        if (now - this.lastOpaWarning < 60_000)
+            return;
+        this.lastOpaWarning = now;
+        console.error(`POLICY WARNING: OPA evaluation unavailable (${cause}). ` +
+            'Falling back to local policy — commands OPA would deny may now be allowed.');
+    }
+    getAllowedClasses(profile) {
+        if (profile.readOnly) {
+            return ['read-only'];
+        }
+        const roleBinding = this.rules.roleBindings[profile.role];
+        if (!roleBinding) {
+            return ['read-only'];
+        }
+        const hostGroup = this.resolveHostGroup(profile);
+        // Falls back to the most restrictive tier, never to the loosest one.
+        return roleBinding[hostGroup] || roleBinding[HOST_GROUPS[0]] || ['read-only'];
+    }
+    /**
+     * Which tier's role binding applies to this profile.
+     *
+     * `profile.group` is authoritative. Without it we still infer from the name
+     * for convenience, but an unrecognised name resolves to the most restrictive
+     * tier: the previous default sent every unrecognised profile to `dev`, so a
+     * production host merely named "web-01" silently received the loosest
+     * permissions in the matrix.
+     */
+    resolveHostGroup(profile) {
+        if (profile.group)
+            return profile.group;
+        const name = profile.name.toLowerCase();
+        if (name.includes('prod'))
+            return 'prod';
+        if (name.includes('staging'))
+            return 'staging';
+        if (/\b(dev|local|test|sandbox)\b/.test(name) || /(^|[-_])(dev|local|test|sandbox)([-_]|$)/.test(name)) {
+            return 'dev';
+        }
+        return HOST_GROUPS[0];
+    }
+    /**
+     * Whether this command trips the profile's approval gate. What happens at the
+     * gate — prompt or deny — is decided by evaluate() from the approvalPolicy.
+     */
+    requiresApproval(profile, needsApproval) {
+        const mode = profile.approvalPolicy;
+        if (mode === 'auto')
+            return false;
+        if (mode === 'ask-all')
+            return true;
+        // ask-destructive and deny both gate on destructive/privileged commands.
+        return needsApproval;
+    }
+    matchesDenylist(command) {
+        return this.denyPatterns.some((pattern) => pattern.test(command));
+    }
+}

package/build/policy/quota.js

@@ -0,0 +1,59 @@
+/**
+ * Per-profile command quota — a circuit breaker for runaway agents.
+ *
+ * The approval gate stops a *destructive* command, and the HTTP rate limiter
+ * caps request rate, but neither bounds total work: a prompt-injected agent
+ * looping over allowed commands stays under both. The quota bounds the day.
+ *
+ * Scope is the profile, not the "agent": MCP gives us no stable client
+ * identity (a stdio server serves exactly one client anyway), so claiming
+ * per-agent accounting would overstate what is actually enforced.
+ */
+const DAY_MS = 24 * 60 * 60 * 1000;
+export class CommandQuota {
+    windowMs;
+    /** Timestamps of counted commands, oldest first, per profile. */
+    hits = new Map();
+    /**
+     * A sliding 24h window rather than a calendar day: a fixed daily reset lets
+     * an agent burn the whole quota, wait for midnight, and immediately burn it
+     * again — twice the intended work in minutes.
+     */
+    constructor(windowMs = DAY_MS) {
+        this.windowMs = windowMs;
+    }
+    /**
+     * Count one command against the profile's quota.
+     * `limit <= 0` (or undefined) means unlimited, and nothing is recorded.
+     */
+    consume(profile, limit, now = Date.now()) {
+        if (!limit || limit <= 0)
+            return { allowed: true, remaining: Infinity };
+        const cutoff = now - this.windowMs;
+        const recent = (this.hits.get(profile) ?? []).filter((t) => t > cutoff);
+        if (recent.length >= limit) {
+            // Refusal must not consume budget, otherwise a blocked agent could keep
+            // pushing the window forward and never recover.
+            this.hits.set(profile, recent);
+            return {
+                allowed: false,
+                remaining: 0,
+                retryAt: new Date(recent[0] + this.windowMs),
+            };
+        }
+        recent.push(now);
+        this.hits.set(profile, recent);
+        return { allowed: true, remaining: limit - recent.length };
+    }
+    /** Commands used in the current window, for status reporting. */
+    used(profile, now = Date.now()) {
+        const cutoff = now - this.windowMs;
+        return (this.hits.get(profile) ?? []).filter((t) => t > cutoff).length;
+    }
+    reset(profile) {
+        if (profile)
+            this.hits.delete(profile);
+        else
+            this.hits.clear();
+    }
+}

package/build/ssh/algorithms.js

@@ -0,0 +1,33 @@
+export const FROZEN_ALGORITHMS = {
+    kex: [
+        'curve25519-sha256',
+        'curve25519-sha256@libssh.org',
+        'ecdh-sha2-nistp256',
+        'ecdh-sha2-nistp384',
+        'ecdh-sha2-nistp521',
+        'diffie-hellman-group16-sha512',
+        'diffie-hellman-group14-sha256',
+    ],
+    cipher: [
+        'chacha20-poly1305@openssh.com',
+        'aes256-gcm@openssh.com',
+        'aes128-gcm@openssh.com',
+        'aes256-ctr',
+        'aes192-ctr',
+        'aes128-ctr',
+    ],
+    serverHostKey: [
+        'ssh-ed25519',
+        'ecdsa-sha2-nistp256',
+        'ecdsa-sha2-nistp384',
+        'ecdsa-sha2-nistp521',
+        'rsa-sha2-512',
+        'rsa-sha2-256',
+    ],
+    hmac: [
+        'hmac-sha2-256-etm@openssh.com',
+        'hmac-sha2-512-etm@openssh.com',
+        'hmac-sha2-256',
+        'hmac-sha2-512',
+    ],
+};

package/build/ssh/channel-retry.js

@@ -0,0 +1,15 @@
+export async function openWithRetry(open, { attempts = 3, delayMs = 150 } = {}) {
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        try {
+            return await open();
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt < attempts) {
+                await new Promise((resolve) => setTimeout(resolve, delayMs * attempt));
+            }
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}

package/build/ssh/connection-registry.js

@@ -0,0 +1,102 @@
+import { getProfile as getConfigProfile } from '../config/loader.js';
+import { resolveCredentials } from '../config/credential-resolver.js';
+import { SSHConnection } from './connection.js';
+export class ConnectionRegistry {
+    connections = new Map();
+    pending = new Map();
+    knownHostsStore = new Map();
+    hostKeyMode;
+    config;
+    constructor(config, hostKeyMode = 'tofu') {
+        this.config = config;
+        this.hostKeyMode = hostKeyMode;
+    }
+    async getOrCreate(profileName) {
+        const profile = this.getProfile(profileName);
+        const existing = this.connections.get(profile.name);
+        if (existing && existing.isConnected()) {
+            return existing;
+        }
+        const inFlight = this.pending.get(profile.name);
+        if (inFlight) {
+            return inFlight;
+        }
+        const promise = (async () => {
+            try {
+                let conn = this.connections.get(profile.name);
+                // A ProxyJump connection runs over a forwarded channel on the bastion.
+                // Once the connection drops, that channel is dead, so reconnecting the
+                // same SSHConnection reuses a corpse and always fails — which used to
+                // burn one tool call on every reconnect before the retry rebuilt it.
+                // Discard the object so the hop is re-established below.
+                if (conn && profile.via && !conn.isConnected()) {
+                    await conn.close().catch(() => { });
+                    this.connections.delete(profile.name);
+                    conn = undefined;
+                }
+                if (!conn) {
+                    let bastionSock;
+                    if (profile.via) {
+                        const bastionConn = await this.getOrCreate(profile.via);
+                        const bastionClient = bastionConn.getClient();
+                        bastionSock = await new Promise((resolve, reject) => {
+                            bastionClient.forwardOut('', 0, profile.host, profile.port, (err, stream) => {
+                                if (err)
+                                    reject(new Error(`ProxyJump via "${profile.via}" failed: ${err.message}`));
+                                else
+                                    resolve(stream);
+                            });
+                        });
+                    }
+                    conn = new SSHConnection(profile, await resolveCredentials(profile), this.knownHostsStore, this.hostKeyMode, bastionSock);
+                    this.connections.set(profile.name, conn);
+                }
+                await conn.ensureConnected();
+                return conn;
+            }
+            catch (err) {
+                this.connections.delete(profile.name);
+                throw err;
+            }
+            finally {
+                this.pending.delete(profile.name);
+            }
+        })();
+        this.pending.set(profile.name, promise);
+        return promise;
+    }
+    get(profileName) {
+        const profile = this.getProfile(profileName);
+        return this.connections.get(profile.name);
+    }
+    getProfile(profileName) {
+        return getConfigProfile(this.config, profileName);
+    }
+    listConnections() {
+        return Array.from(this.connections.values()).map((c) => c.toInfo());
+    }
+    listAllProfiles() {
+        return this.config.profiles;
+    }
+    reapIdleConnections() {
+        const idleThreshold = Date.now() - this.config.defaults.connectionIdleReapMs;
+        const viaTargets = new Set(this.config.profiles
+            .map((p) => p.via)
+            .filter((v) => !!v));
+        for (const [name, conn] of this.connections) {
+            if (viaTargets.has(name))
+                continue;
+            const info = conn.toInfo();
+            if (info.sessionCount === 0 && info.lastActivity && info.lastActivity.getTime() < idleThreshold) {
+                conn.close().catch(() => { });
+                this.connections.delete(name);
+            }
+        }
+    }
+    async closeAll() {
+        for (const conn of this.connections.values()) {
+            await conn.close().catch(() => { });
+        }
+        this.connections.clear();
+    }
+}