ssh-mcp 2.2.1 → 2.2.2

package/README.md

@@ -378,6 +378,19 @@ distinguishable from a fresh human answer.
 **Off by default** (`0` = always prompt). Auto-approval weakens the gate that
 makes destructive commands safe, so turning it on should be a decision.
 
+#### Answering the prompt
+
+Approval goes through the MCP elicitation request, so what you see is your
+client's dialog. Accepting it approves the command — there is no second field to
+fill in.
+
+You have **10 minutes** to answer. Past that the request expires and the command
+is refused rather than left pending, and the refusal says so; the prompt may
+still be open in your client, in which case run the command again once you are
+ready. If your client does not support elicitation at all, every destructive and
+privileged command is refused with `APPROVAL_UNAVAILABLE` naming that cause —
+approval fails closed by design.
+
 ### Command Quota
 
 `commandQuotaPerDay` bounds how many commands a profile may run in a rolling

package/build/guard/elicitation.js

@@ -1,3 +1,17 @@
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+/**
+ * How long a person has to read a destructive command and decide.
+ *
+ * Explicit because the SDK's DEFAULT_REQUEST_TIMEOUT_MSEC is 60 seconds, and
+ * inheriting it here set a human's reading time from a default chosen for
+ * machine round trips. An operator who stepped away, or who was working out an
+ * unfamiliar dialog, had the request expire underneath them and the command
+ * refused (#91).
+ *
+ * Ten minutes is long enough to be interrupted and come back, and still bounded
+ * so a client that never answers cannot pin a tool call open forever.
+ */
+export const APPROVAL_TIMEOUT_MS = 600_000;
 /**
  * Ask the MCP client to confirm a destructive or privileged command.
  *
@@ -6,8 +20,9 @@
  * of silently disabling the gate that guards every destructive command.
  *
  * Fails closed: any error (client without elicitation support, transport
- * failure, malformed reply) denies the command. The failure is logged, because
- * a gate that always denies for an unnoticed reason is its own kind of outage.
+ * failure, timeout, malformed reply) denies the command. The failure is logged,
+ * because a gate that always denies for an unnoticed reason is its own kind of
+ * outage.
  */
 export async function requestApproval(server, command, profileName, evaluation) {
     const message = `Confirm ${evaluation.commandClass} command on "${profileName}":\n\n${command}`;
@@ -22,26 +37,47 @@ export async function requestApproval(server, command, profileName, evaluation)
                         title: 'Approve this command?',
                     },
                 },
-                required: ['confirm'],
+                // `confirm` is deliberately not required. The protocol already carries
+                // the decision in `action`, where accept and decline are distinct
+                // results, so requiring a boolean on top asked the user to say the
+                // same thing twice — and clients render a required boolean as a
+                // checkbox beside the accept/decline row. Choosing Accept without
+                // ticking it submits a form missing a required field, so the client
+                // can produce no valid result and sends `cancel`, which arrived here
+                // as "User did not approve this command". The user picked Approve and
+                // was told they had declined (#91).
             },
-        });
-        if (result.action === 'accept' && result.content?.confirm === true) {
+        }, { timeout: APPROVAL_TIMEOUT_MS });
+        // `action` decides. An explicit `confirm: false` from a client that still
+        // sends the field is honoured, because refusing to run on an explicit "no"
+        // costs nothing and reading it as approval would be indefensible.
+        if (result.action === 'accept' && result.content?.confirm !== false) {
             return { approved: true, approver: 'mcp-client' };
         }
         return { approved: false };
     }
     catch (err) {
+        const timedOut = err instanceof McpError && err.code === ErrorCode.RequestTimeout;
         const cause = err instanceof Error ? err.message : String(err);
         // stderr still gets it for the operator's logs, but it cannot be the only
         // copy: for a stdio MCP server that is a client log file nobody reads, so
         // the caller gets the diagnosis too and can put it in front of the user.
         console.error(`Approval request failed for ${evaluation.commandClass} command on "${profileName}" — denying. ` +
-            `Does this client support elicitation? Cause: ${cause}`);
+            `${timedOut ? `No answer within ${APPROVAL_TIMEOUT_MS / 1000}s.` : 'Does this client support elicitation?'} ` +
+            `Cause: ${cause}`);
+        // Naming the cause rather than guessing at it. This message was introduced
+        // to stop APPROVAL_DENIED covering two different failures, and then led with
+        // "a client without elicitation support" for every error the catch saw,
+        // timeouts included — the same defect, inside its own fix.
         return {
             approved: false,
-            unavailable: `this MCP client could not be asked to approve it. The likely cause is a client without ` +
-                `elicitation support; a transport failure or a malformed reply does the same. Approval fails ` +
-                `closed, so the command was refused rather than run. Underlying error: ${cause}`,
+            unavailable: timedOut
+                ? `no answer arrived within ${APPROVAL_TIMEOUT_MS / 1000}s, so it was refused rather than left ` +
+                    `pending. The prompt may still be open in your client; approve the command again once you are ` +
+                    `ready to answer it.`
+                : `this MCP client could not be asked to approve it. The likely cause is a client without ` +
+                    `elicitation support; a transport failure or a malformed reply does the same. Approval fails ` +
+                    `closed, so the command was refused rather than run. Underlying error: ${cause}`,
         };
     }
 }

package/build/index.js

@@ -24,6 +24,27 @@ function parseArgv() {
     }
     return config;
 }
+/**
+ * Whether a boolean flag was passed at all.
+ *
+ * `parseArgv` stores `null` for a flag written without `=`, which is how every
+ * documented boolean flag is written. Testing that value for truthiness makes
+ * the flag a no-op: `--disableApproval`, `--auditEntropyScan` and
+ * `--auditTamperEvident` all did nothing unless spelled `--flag=1`, which
+ * nothing documents (#91). The two call sites that got it right already used
+ * `!== undefined`; this gives the check a name so the next one cannot miss it.
+ *
+ * `--flag=false` and `--flag=0` turn it off, because a flag that cannot be
+ * turned off once written into a wrapper script is its own annoyance.
+ */
+function flagEnabled(argv, name) {
+    if (!(name in argv))
+        return false;
+    const value = argv[name];
+    if (value === null || value === '')
+        return true;
+    return !['false', '0', 'no', 'off'].includes(value.toLowerCase());
+}
 /**
  * v1 flags that v2 removed. Silently ignoring them means the user only finds
  * out at the first command, as an auth failure with no hint about the cause.
@@ -62,7 +83,7 @@ function parseMaxChars(raw) {
  * existed. `--insecureHostKey` is kept as an alias for the documented flag.
  */
 function resolveHostKeyMode(argv) {
-    if (argv.insecureHostKey !== undefined)
+    if (flagEnabled(argv, 'insecureHostKey'))
         return 'insecure';
     const mode = argv.hostKeyMode;
     if (mode === null || mode === undefined)
@@ -134,7 +155,7 @@ async function buildAppConfig(argv) {
         role: 'admin',
         group: resolveHostGroup(argv),
         readOnly: false,
-        approvalPolicy: argv.disableApproval ? 'auto' : defaults.approvalMode,
+        approvalPolicy: flagEnabled(argv, 'disableApproval') ? 'auto' : defaults.approvalMode,
         cert: false,
         sessionMaxPerConnection: defaults.sessionMaxPerConnection,
         sessionIdleTimeoutMs: defaults.sessionIdleTimeoutMs,
@@ -152,8 +173,8 @@ async function main() {
     }
     const config = await buildAppConfig(argv);
     const hostKeyMode = resolveHostKeyMode(argv);
-    const entropyScan = !!argv.auditEntropyScan;
-    const tamperEvident = !!argv.auditTamperEvident;
+    const entropyScan = flagEnabled(argv, 'auditEntropyScan');
+    const tamperEvident = flagEnabled(argv, 'auditTamperEvident');
     await initKeychain();
     if (argv.otelEndpoint) {
         const { initTracing } = await import('./observability/tracer.js');
@@ -242,4 +263,4 @@ if (isCliEnabled || isTestMode) {
         process.exit(1);
     });
 }
-export { parseArgv, buildAppConfig, checkRemovedFlags, parseMaxChars };
+export { parseArgv, buildAppConfig, checkRemovedFlags, parseMaxChars, flagEnabled, resolveHostKeyMode };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {