ssh-mcp 2.0.2 → 2.0.4

package/build/policy/classifier.js

@@ -1,3 +1,21 @@
+/**
+ * Anything through which the shell can start a second command.
+ *
+ * This gate decides whether an allowlisted binary counts as read-only, and the
+ * allowlist only vouches for the binary — never for what a shell might run
+ * beside it. It used to test /[>;|]/, which let `ls $(touch /tmp/x)` through as
+ * read-only: `ls` is allowlisted, no listed metacharacter appears, and the
+ * remote shell expands the substitution and runs the inner command anyway
+ * (GHSA-r8hm-vpm8-cfh6).
+ *
+ * Listing every dangerous construct is a losing game — `$()`, backticks,
+ * `<(...)`, `${x:=...}`, `&&`, a bare newline — so this refuses every character
+ * with syntactic meaning to the shell instead, and `$` wholesale rather than
+ * just `$(`. The cost is that `echo $HOME` is no longer classified read-only.
+ * That is the right trade for the tool whose entire promise is that it cannot
+ * write: run-command still accepts it under policy.
+ */
+const SHELL_CONTROL_CHARS = /[;&|<>`$(){}\n\r]/;
 const READ_ONLY_ALLOWLIST = new Set([
     'ls', 'cat', 'grep', 'find', 'stat', 'df', 'du', 'head', 'tail', 'wc',
     'ps', 'uname', 'uptime', 'hostname', 'id', 'who', 'whoami', 'date',
@@ -98,7 +116,7 @@ export function classifyCommand(command) {
     }
     const twoWordPrefix = fullCommand.split(/\s+/).slice(0, 2).join(' ');
     if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)) {
-        if (/[>;|]/.test(trimmed)) {
+        if (SHELL_CONTROL_CHARS.test(trimmed)) {
             return { binary, fullCommand, class: 'safe' };
         }
         return { binary, fullCommand, class: 'read-only' };

package/build/ssh/connection.js

@@ -28,12 +28,25 @@ export class SSHConnection {
         this.sessions = new SessionManager({
             // Live read: the profile object can be replaced after construction.
             profile: () => this.profile,
-            openShell: () => new Promise((resolve, reject) => {
-                this.getClient().shell({ term: 'xterm-256color', cols: 200, rows: 50 }, (err, stream) => (err ? reject(err) : resolve(stream)));
-            }),
-            openExec: (command) => new Promise((resolve, reject) => {
-                this.getClient().exec(this.applyWorkdir(command), (err, stream) => (err ? reject(err) : resolve(stream)));
-            }),
+            // ensureConnected inside the callback, not just before the retry: these
+            // run under openWithRetry, and Dropbear drops the whole connection under
+            // channel churn rather than merely refusing the channel. openSession does
+            // check the link first, but the link can die between that check and the
+            // channel opening — and then every retry reached getClient() on a dead
+            // client and threw the same "SSH connection not established", so the retry
+            // re-ran a corpse three times. SftpClient already did it this way.
+            openShell: async () => {
+                await this.ensureConnected();
+                return new Promise((resolve, reject) => {
+                    this.getClient().shell({ term: 'xterm-256color', cols: 200, rows: 50 }, (err, stream) => (err ? reject(err) : resolve(stream)));
+                });
+            },
+            openExec: async (command) => {
+                await this.ensureConnected();
+                return new Promise((resolve, reject) => {
+                    this.getClient().exec(this.applyWorkdir(command), (err, stream) => (err ? reject(err) : resolve(stream)));
+                });
+            },
             onChannelOpened: () => { this.activeChannels++; },
             onChannelClosed: () => { this.activeChannels--; },
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {