ssh-mcp 2.0.0 → 2.0.2

package/README.md

@@ -2,6 +2,8 @@
 
 [![NPM Version](https://img.shields.io/npm/v/ssh-mcp)](https://www.npmjs.com/package/ssh-mcp)
 [![Downloads](https://img.shields.io/npm/dm/ssh-mcp)](https://www.npmjs.com/package/ssh-mcp)
+[![CI](https://github.com/tufantunc/ssh-mcp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/tufantunc/ssh-mcp/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/tufantunc/ssh-mcp/branch/main/graph/badge.svg)](https://codecov.io/gh/tufantunc/ssh-mcp)
 [![License](https://img.shields.io/github/license/tufantunc/ssh-mcp)](./LICENSE)
 [![GitHub issues](https://img.shields.io/github/issues/tufantunc/ssh-mcp)](https://github.com/tufantunc/ssh-mcp/issues)
 

package/build/config/loader.js

@@ -91,6 +91,16 @@ function normalizeConfig(raw) {
 export function getProfile(config, name) {
     const targetName = name || config.defaults.defaultProfile;
     if (!targetName) {
+        // Falling back to profiles[0] meant that with several hosts configured and
+        // no default chosen, a command with no profile argument ran against
+        // whichever host happened to be listed first — silently, and typically the
+        // one written down first, which tends to be production. One profile is
+        // unambiguous; more than one is a question the caller has to answer.
+        if (config.profiles.length > 1) {
+            const names = config.profiles.map((p) => p.name).join(', ');
+            throw new Error(`No profile selected and no default configured, but ${config.profiles.length} profiles exist: ${names}. ` +
+                `Pass a "profile" argument, or set defaults.defaultProfile in the config.`);
+        }
         return config.profiles[0];
     }
     const profile = config.profiles.find((p) => p.name === targetName);

package/build/policy/classifier.js

@@ -28,25 +28,34 @@ const READ_ONLY_ALLOWLIST = new Set([
  * pattern was narrower). Anything here is also destructive for classification
  * purposes; see DESTRUCTIVE_DENYLIST below.
  */
+/*
+ * Every `\s+` here is followed by a literal. Where a `.*` or `[^|]*` comes
+ * next, the quantifier before it is a single `\s`: `\s+.*` lets both halves
+ * claim the same run of spaces, so a non-matching command is retried from every
+ * split and the match goes quadratic. sanitizeCommand caps commands at
+ * profile.maxChars (5000 by default) long before this runs, which is what keeps
+ * that cheap — but a policy check should not depend on a limit set three layers
+ * away and configurable to any value.
+ */
 const FORBIDDEN_PATTERNS = [
     /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
     /mkfs\./,
-    /dd\s+.*\bof=\/dev\//,
+    /dd\s.*\bof=\/dev\//,
     />\s*\/dev\/sd/,
     /\bshutdown\b/,
     /\breboot\b/,
     /\bhalt\b/,
     /\bpoweroff\b/,
     /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
-    /curl\s+.*\|\s*(sh|bash|zsh)/,
-    /wget\s+.*\|\s*(sh|bash|zsh)/,
+    /curl\s[^|]*\|\s*(sh|bash|zsh)/,
+    /wget\s[^|]*\|\s*(sh|bash|zsh)/,
     /\beval\b/,
     />\s*\/etc\/cron/,
     />\s*\/etc\/systemd/,
     />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
-    /\bchown\s+-R\s+.*\s+\/\s*$/,
+    /\bchown\s+-R\s.*\s\/\s*$/,
 ];
 /**
  * Commands that are destructive but legitimate under approval — e.g.

package/build/ssh/host-key.js

@@ -1,7 +1,11 @@
 import { createHash } from 'crypto';
 export function fingerprintPublicKey(key) {
     const hash = createHash('sha256').update(key).digest('base64');
-    return `SHA256:${hash.replace(/=+$/, '')}`;
+    // `={0,2}` rather than `=+`: base64 padding is never longer than two
+    // characters, and the bounded form cannot backtrack. Not reachable here — the
+    // input is always a 44-character digest — but an unbounded trailing
+    // quantifier is the shape worth not copying elsewhere.
+    return `SHA256:${hash.replace(/={0,2}$/, '')}`;
 }
 export function verifyHostKey(host, port, fingerprint, knownHosts, mode) {
     if (mode === 'insecure')

package/build/ssh/session.js

@@ -1,8 +1,45 @@
+import { randomBytes } from 'crypto';
 import { tracer } from '../observability/tracer.js';
 const ANSI_REGEX = /\x1b\[[0-9;?]*[a-zA-Z]|\x1b\][^\x07]*\x07|\r/g;
 export function stripAnsi(text) {
     return text.replace(ANSI_REGEX, '');
 }
+/**
+ * Trim leading and trailing newlines by index rather than with /^\n+/ and
+ * /\n+$/.
+ *
+ * The trailing pattern is unanchored at the start, so on output that is mostly
+ * newlines but does not end in one the engine retries `\n+` from every offset:
+ * quadratic in the length of the output. That output is whatever the remote
+ * command printed and the session buffer holds up to 2 MB of it, which measured
+ * at roughly 25 minutes of blocked event loop — and the loop is shared by every
+ * session and connection this server has open.
+ */
+/**
+ * A per-command marker separating the command's own output from the trailer
+ * carrying `$?` and `$PWD`.
+ *
+ * Guessing one is enough to forge an exit code or a working directory — a
+ * failed command reported as successful, in a server whose whole claim is an
+ * auditable record of what ran. Every marker is written to the remote host in
+ * the clear, so anything watching that session collects a stream of them, and
+ * Math.random() is reconstructible from such a stream.
+ *
+ * base64url keeps the value safe both inside the single-quoted printf that
+ * emits it and inside the RegExp built from it: no quotes, no metacharacters.
+ */
+export function generateSessionMarker() {
+    return randomBytes(12).toString('base64url');
+}
+export function trimNewlines(text) {
+    let start = 0;
+    let end = text.length;
+    while (start < end && text.charCodeAt(start) === 10)
+        start++;
+    while (end > start && text.charCodeAt(end - 1) === 10)
+        end--;
+    return start === 0 && end === text.length ? text : text.slice(start, end);
+}
 export class Session {
     id;
     name;
@@ -143,7 +180,7 @@ export class InteractiveSession extends Session {
                         : cleaned;
                     const endIdx = afterBegin.indexOf(endMarker);
                     const between = endIdx >= 0 ? afterBegin.slice(0, endIdx) : afterBegin;
-                    const output = between.replace(/^\n+/, '').replace(/\n+$/, '');
+                    const output = trimNewlines(between);
                     if (reportedCwd)
                         this.cwd = reportedCwd;
                     this.touch();
@@ -205,7 +242,7 @@ export class InteractiveSession extends Session {
         });
     }
     generateMarker() {
-        return Math.random().toString(36).substring(2, 14) + Date.now().toString(36);
+        return generateSessionMarker();
     }
     async close() {
         try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {
@@ -43,6 +43,7 @@
     "@changesets/cli": "^2.31.0",
     "@types/node": "^24.5.2",
     "@types/ssh2": "^1.15.5",
+    "@vitest/coverage-v8": "^3.2.7",
     "cross-env": "^7.0.3",
     "fast-check": "^3.23.2",
     "shx": "^0.4.0",