ssh-mcp 2.2.1 → 2.2.3

package/README.md

@@ -150,7 +150,7 @@ sessionMaxPerConnection = 5
 sessionIdleTimeoutMs = 600000       # 10min
 sessionBackgroundMaxMs = 3600000    # 1hr
 commandTimeoutMs = 60000
-commandMaxChars = 5000
+commandMaxChars = 5000              # 0 = unlimited, the config spelling of --maxChars=none
 commandMaxOutputBytes = 1048576     # 1MB
 connectionIdleReapMs = 900000       # 15min
 commandQuotaPerDay = 0              # 0 = unlimited; circuit breaker for runaway agents
@@ -177,6 +177,7 @@ cert = false                        # SSH CA cert auth — auto-detects keyRef-c
 sessionMaxPerConnection = 3         # per-profile override
 sessionIdleTimeoutMs = 300000       # stricter for prod
 commandQuotaPerDay = 200            # per-profile override
+maxChars = 2000                     # per-profile override; stricter for prod
 
 # Optional. Merged over the built-in role matrix; see "Policy Engine" below.
 # roleBindings is keyed by role and then by tier, so the block below changes
@@ -378,6 +379,19 @@ distinguishable from a fresh human answer.
 **Off by default** (`0` = always prompt). Auto-approval weakens the gate that
 makes destructive commands safe, so turning it on should be a decision.
 
+#### Answering the prompt
+
+Approval goes through the MCP elicitation request, so what you see is your
+client's dialog. Accepting it approves the command — there is no second field to
+fill in.
+
+You have **10 minutes** to answer. Past that the request expires and the command
+is refused rather than left pending, and the refusal says so; the prompt may
+still be open in your client, in which case run the command again once you are
+ready. If your client does not support elicitation at all, every destructive and
+privileged command is refused with `APPROVAL_UNAVAILABLE` naming that cause —
+approval fails closed by design.
+
 ### Command Quota
 
 `commandQuotaPerDay` bounds how many commands a profile may run in a rolling
@@ -541,7 +555,7 @@ Secrets are **never** passed as CLI arguments.
 | `--workdir` | — | Quick start: Working directory for commands and sessions |
 | `--group` | prod | Quick start: Policy tier — `prod`, `staging` or `dev` |
 | `--timeout` | 60000 | Command timeout in ms |
-| `--maxChars` | 5000 | Max command length (`none` or `0` disables the limit) |
+| `--maxChars` | 5000 | Max command length (`none` or `0` disables the limit; in a config file the same setting is `commandMaxChars = 0`) |
 | `--sessionMax` | 5 | Max concurrent sessions per connection |
 | `--sessionTtl` | 600000 | Session idle timeout in ms |
 | `--transport` | stdio | `stdio` or `http` |

package/build/config/loader.js

@@ -67,6 +67,22 @@ export async function loadConfig(customPath) {
     }
     return normalizeConfig(result.data);
 }
+/**
+ * `0` means unlimited, the convention `commandQuotaPerDay` and
+ * `approvalGrantTtlMs` already use in this config file.
+ *
+ * It has to be *mapped* rather than merely permitted. `sanitizeCommand` tests
+ * `cleaned.length > maxChars`, so a literal `0` arriving there rejects every
+ * non-empty command with "Command is too long (max 0 characters)" — a worse
+ * failure than the one this spelling exists to fix.
+ *
+ * MAX_SAFE_INTEGER is the value `parseMaxChars` produces for `--maxChars=none`,
+ * so the flag and the config file hand the rest of the code an identical
+ * Profile rather than two spellings of uncapped (#123).
+ */
+function uncapZero(maxChars) {
+    return maxChars === 0 ? Number.MAX_SAFE_INTEGER : maxChars;
+}
 /**
  * Resolve every profile against [defaults]. Each of these keys is documented as
  * a default that profiles inherit, so all of them must cascade — a key that is
@@ -75,13 +91,23 @@ export async function loadConfig(customPath) {
  * downgrade, not just a papercut).
  */
 function normalizeConfig(raw) {
+    // commandMaxChars is mapped here as well as on the profile below, so no `0`
+    // survives anywhere in AppConfig. Leaving the raw value on `defaults` left one
+    // object carrying two encodings of "unlimited" — `profile.maxChars` as
+    // MAX_SAFE_INTEGER, `defaults.commandMaxChars` as 0 — with nothing in the
+    // types to tell them apart. index.ts:161 already copies straight across
+    // (`maxChars: defaults.commandMaxChars`), and was correct only because that
+    // path's value comes from parseMaxChars, which never returns 0. Correct by
+    // coincidence of another surface is not a property to leave standing when the
+    // wrong encoding rejects every non-empty command.
     const defaults = {
         ...raw.defaults,
+        commandMaxChars: uncapZero(raw.defaults.commandMaxChars),
     };
     const profiles = raw.profiles.map((p) => ({
         ...p,
         timeout: p.timeout ?? defaults.commandTimeoutMs,
-        maxChars: p.maxChars ?? defaults.commandMaxChars,
+        maxChars: uncapZero(p.maxChars ?? defaults.commandMaxChars),
         maxOutputBytes: p.maxOutputBytes ?? defaults.commandMaxOutputBytes,
         approvalPolicy: p.approvalPolicy ?? defaults.approvalMode,
         sessionMaxPerConnection: p.sessionMaxPerConnection ?? defaults.sessionMaxPerConnection,

package/build/config/schema.js

@@ -18,7 +18,10 @@ export const defaultsSchema = z.object({
     sessionIdleTimeoutMs: z.number().int().positive().default(600_000),
     sessionBackgroundMaxMs: z.number().int().positive().default(3_600_000),
     commandTimeoutMs: z.number().int().positive().default(60_000),
-    commandMaxChars: z.number().int().positive().default(5000),
+    // 0 = unlimited, matching `--maxChars=none` on the CLI. normalizeConfig()
+    // maps it to Number.MAX_SAFE_INTEGER so both surfaces hand the rest of the
+    // code an identical Profile.
+    commandMaxChars: z.number().int().nonnegative().default(5000),
     commandMaxOutputBytes: z.number().int().positive().default(1_048_576),
     connectionIdleReapMs: z.number().int().positive().default(900_000),
     // 0 = unlimited. A circuit breaker for runaway agents, not a rate limit.
@@ -50,7 +53,8 @@ export const profileSchema = z.object({
     // a schema-level .default() would make "user omitted it" indistinguishable
     // from "user set the default value", silently shadowing [defaults].
     timeout: z.number().int().positive().optional(),
-    maxChars: z.number().int().positive().optional(),
+    // 0 = unlimited, as in [defaults].commandMaxChars above.
+    maxChars: z.number().int().nonnegative().optional(),
     maxOutputBytes: z.number().int().positive().optional(),
     approvalPolicy: approvalModeSchema.optional(),
     sessionMaxPerConnection: z.number().int().positive().optional(),

package/build/guard/elicitation.js

@@ -1,3 +1,17 @@
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+/**
+ * How long a person has to read a destructive command and decide.
+ *
+ * Explicit because the SDK's DEFAULT_REQUEST_TIMEOUT_MSEC is 60 seconds, and
+ * inheriting it here set a human's reading time from a default chosen for
+ * machine round trips. An operator who stepped away, or who was working out an
+ * unfamiliar dialog, had the request expire underneath them and the command
+ * refused (#91).
+ *
+ * Ten minutes is long enough to be interrupted and come back, and still bounded
+ * so a client that never answers cannot pin a tool call open forever.
+ */
+export const APPROVAL_TIMEOUT_MS = 600_000;
 /**
  * Ask the MCP client to confirm a destructive or privileged command.
  *
@@ -6,8 +20,9 @@
  * of silently disabling the gate that guards every destructive command.
  *
  * Fails closed: any error (client without elicitation support, transport
- * failure, malformed reply) denies the command. The failure is logged, because
- * a gate that always denies for an unnoticed reason is its own kind of outage.
+ * failure, timeout, malformed reply) denies the command. The failure is logged,
+ * because a gate that always denies for an unnoticed reason is its own kind of
+ * outage.
  */
 export async function requestApproval(server, command, profileName, evaluation) {
     const message = `Confirm ${evaluation.commandClass} command on "${profileName}":\n\n${command}`;
@@ -22,26 +37,47 @@ export async function requestApproval(server, command, profileName, evaluation)
                         title: 'Approve this command?',
                     },
                 },
-                required: ['confirm'],
+                // `confirm` is deliberately not required. The protocol already carries
+                // the decision in `action`, where accept and decline are distinct
+                // results, so requiring a boolean on top asked the user to say the
+                // same thing twice — and clients render a required boolean as a
+                // checkbox beside the accept/decline row. Choosing Accept without
+                // ticking it submits a form missing a required field, so the client
+                // can produce no valid result and sends `cancel`, which arrived here
+                // as "User did not approve this command". The user picked Approve and
+                // was told they had declined (#91).
             },
-        });
-        if (result.action === 'accept' && result.content?.confirm === true) {
+        }, { timeout: APPROVAL_TIMEOUT_MS });
+        // `action` decides. An explicit `confirm: false` from a client that still
+        // sends the field is honoured, because refusing to run on an explicit "no"
+        // costs nothing and reading it as approval would be indefensible.
+        if (result.action === 'accept' && result.content?.confirm !== false) {
             return { approved: true, approver: 'mcp-client' };
         }
         return { approved: false };
     }
     catch (err) {
+        const timedOut = err instanceof McpError && err.code === ErrorCode.RequestTimeout;
         const cause = err instanceof Error ? err.message : String(err);
         // stderr still gets it for the operator's logs, but it cannot be the only
         // copy: for a stdio MCP server that is a client log file nobody reads, so
         // the caller gets the diagnosis too and can put it in front of the user.
         console.error(`Approval request failed for ${evaluation.commandClass} command on "${profileName}" — denying. ` +
-            `Does this client support elicitation? Cause: ${cause}`);
+            `${timedOut ? `No answer within ${APPROVAL_TIMEOUT_MS / 1000}s.` : 'Does this client support elicitation?'} ` +
+            `Cause: ${cause}`);
+        // Naming the cause rather than guessing at it. This message was introduced
+        // to stop APPROVAL_DENIED covering two different failures, and then led with
+        // "a client without elicitation support" for every error the catch saw,
+        // timeouts included — the same defect, inside its own fix.
         return {
             approved: false,
-            unavailable: `this MCP client could not be asked to approve it. The likely cause is a client without ` +
-                `elicitation support; a transport failure or a malformed reply does the same. Approval fails ` +
-                `closed, so the command was refused rather than run. Underlying error: ${cause}`,
+            unavailable: timedOut
+                ? `no answer arrived within ${APPROVAL_TIMEOUT_MS / 1000}s, so it was refused rather than left ` +
+                    `pending. The prompt may still be open in your client; approve the command again once you are ` +
+                    `ready to answer it.`
+                : `this MCP client could not be asked to approve it. The likely cause is a client without ` +
+                    `elicitation support; a transport failure or a malformed reply does the same. Approval fails ` +
+                    `closed, so the command was refused rather than run. Underlying error: ${cause}`,
         };
     }
 }

package/build/index.js

@@ -24,6 +24,27 @@ function parseArgv() {
     }
     return config;
 }
+/**
+ * Whether a boolean flag was passed at all.
+ *
+ * `parseArgv` stores `null` for a flag written without `=`, which is how every
+ * documented boolean flag is written. Testing that value for truthiness makes
+ * the flag a no-op: `--disableApproval`, `--auditEntropyScan` and
+ * `--auditTamperEvident` all did nothing unless spelled `--flag=1`, which
+ * nothing documents (#91). The two call sites that got it right already used
+ * `!== undefined`; this gives the check a name so the next one cannot miss it.
+ *
+ * `--flag=false` and `--flag=0` turn it off, because a flag that cannot be
+ * turned off once written into a wrapper script is its own annoyance.
+ */
+function flagEnabled(argv, name) {
+    if (!(name in argv))
+        return false;
+    const value = argv[name];
+    if (value === null || value === '')
+        return true;
+    return !['false', '0', 'no', 'off'].includes(value.toLowerCase());
+}
 /**
  * v1 flags that v2 removed. Silently ignoring them means the user only finds
  * out at the first command, as an auth failure with no hint about the cause.
@@ -62,7 +83,7 @@ function parseMaxChars(raw) {
  * existed. `--insecureHostKey` is kept as an alias for the documented flag.
  */
 function resolveHostKeyMode(argv) {
-    if (argv.insecureHostKey !== undefined)
+    if (flagEnabled(argv, 'insecureHostKey'))
         return 'insecure';
     const mode = argv.hostKeyMode;
     if (mode === null || mode === undefined)
@@ -134,7 +155,7 @@ async function buildAppConfig(argv) {
         role: 'admin',
         group: resolveHostGroup(argv),
         readOnly: false,
-        approvalPolicy: argv.disableApproval ? 'auto' : defaults.approvalMode,
+        approvalPolicy: flagEnabled(argv, 'disableApproval') ? 'auto' : defaults.approvalMode,
         cert: false,
         sessionMaxPerConnection: defaults.sessionMaxPerConnection,
         sessionIdleTimeoutMs: defaults.sessionIdleTimeoutMs,
@@ -152,8 +173,8 @@ async function main() {
     }
     const config = await buildAppConfig(argv);
     const hostKeyMode = resolveHostKeyMode(argv);
-    const entropyScan = !!argv.auditEntropyScan;
-    const tamperEvident = !!argv.auditTamperEvident;
+    const entropyScan = flagEnabled(argv, 'auditEntropyScan');
+    const tamperEvident = flagEnabled(argv, 'auditTamperEvident');
     await initKeychain();
     if (argv.otelEndpoint) {
         const { initTracing } = await import('./observability/tracer.js');
@@ -242,4 +263,4 @@ if (isCliEnabled || isTestMode) {
         process.exit(1);
     });
 }
-export { parseArgv, buildAppConfig, checkRemovedFlags, parseMaxChars };
+export { parseArgv, buildAppConfig, checkRemovedFlags, parseMaxChars, flagEnabled, resolveHostKeyMode };

package/build/policy/classifier.js

@@ -47,28 +47,38 @@ const READ_ONLY_ALLOWLIST = new Set([
  * purposes; see DESTRUCTIVE_DENYLIST below.
  */
 /*
- * Every `\s+` here is followed by a literal. Where a `.*` or `[^|]*` comes
- * next, the quantifier before it is a single `\s`: `\s+.*` lets both halves
- * claim the same run of spaces, so a non-matching command is retried from every
- * split and the match goes quadratic. sanitizeCommand caps commands at
- * profile.maxChars (5000 by default) long before this runs, which is what keeps
- * that cheap — but a policy check should not depend on a limit set three layers
- * away and configurable to any value.
+ * These are the patterns that stayed regexes, and every one of them is linear.
+ *
+ * The four that were not — `dd\s.*\bof=/dev/`, the two `curl|wget …\|\s*(sh…)`
+ * forms, and `chown\s+-R\s.*\s/\s*$` — are now segment checks below. An earlier
+ * comment here reasoned that ambiguity *within* a match was the only cost, and
+ * that was wrong: the engine also restarts at every offset where the cheap
+ * literal head matches, so a command built from `dd curl wget chown -R x `
+ * repeated ran at 4x per doubling. Measured on the real chain: 64 KB took
+ * 255 ms, 1 MB took 65 seconds of blocked event loop, and the stall lands in
+ * classifyCommand — before the approval gate and before the allow/deny
+ * decision, so no role, approval mode or readOnly flag protects against it.
+ *
+ * The old note said sanitizeCommand's maxChars cap kept this cheap, "but a
+ * policy check should not depend on a limit set three layers away and
+ * configurable to any value". Once a config file could say `commandMaxChars = 0`
+ * (#123) that limit went away, and the prediction came true. The rewrite below
+ * is what that sentence was asking for: the policy check is now safe on its own
+ * terms, whatever maxChars says.
+ *
+ * The existing cost test did not catch it because its seeds are runs of spaces,
+ * which never match the literal heads and so never trigger the restart.
  */
 const FORBIDDEN_PATTERNS = [
     /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
     /mkfs\./,
-    /dd\s.*\bof=\/dev\//,
     />\s*\/dev\/sd/,
     /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
-    /curl\s[^|]*\|\s*(sh|bash|zsh)/,
-    /wget\s[^|]*\|\s*(sh|bash|zsh)/,
     />\s*\/etc\/cron/,
     />\s*\/etc\/systemd/,
     />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
-    /\bchown\s+-R\s.*\s\/\s*$/,
 ];
 /**
  * Words that are forbidden when *invoked*, which the patterns above cannot
@@ -104,20 +114,12 @@ function stripPath(word) {
     const slash = word.lastIndexOf('/');
     return slash === -1 ? word : word.slice(slash + 1);
 }
-/**
- * The command words a shell would actually execute — the head of every
- * `;`/`&&`/`||`/`|`/newline-separated segment, past any privilege prefix, plus
- * the arguments of a multiplexer like `systemctl`.
- *
- * Pure string work: split, trim, set lookups. No quantifiers, so nothing here
- * can backtrack.
- */
-function invokedWords(command) {
-    const invoked = [];
-    for (const segment of command.split(/[;&|\n]/)) {
-        const words = segment.trim().split(/\s+/).filter(Boolean).map(stripPath);
+function parseSegments(command) {
+    const segments = [];
+    for (const raw of command.split(/[;&|\n]/)) {
+        const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
-        while (i < words.length && PRIVILEGE_PREFIXES.has(words[i])) {
+        while (i < words.length && PRIVILEGE_PREFIXES.has(stripPath(words[i]))) {
             i++;
             while (i < words.length && words[i].startsWith('-')) {
                 const consumesValue = PREFIX_VALUE_FLAGS.has(words[i]);
@@ -126,25 +128,73 @@ function invokedWords(command) {
                     i++;
             }
         }
-        const head = words[i];
-        if (!head)
-            continue;
+        if (i < words.length) {
+            segments.push({ head: stripPath(words[i]), args: words.slice(i + 1) });
+        }
+    }
+    return segments;
+}
+function invokedWords(command) {
+    const invoked = [];
+    for (const { head, args } of parseSegments(command)) {
         invoked.push(head);
         // `systemctl reboot` restarts the host. Reading a unit that happens to be
         // named after a power action is rare enough that erring towards refusal
         // here costs little.
         if (ACTION_MULTIPLEXERS.has(head)) {
-            invoked.push(...words.slice(i + 1).filter((w) => !w.startsWith('-')));
+            invoked.push(...args.filter((w) => !w.startsWith('-')).map(stripPath));
         }
     }
     return invoked;
 }
+const SHELLS = new Set(['sh', 'bash', 'zsh']);
+const DOWNLOADERS = new Set(['curl', 'wget']);
+/**
+ * A download piped into a shell.
+ *
+ * Split on `|` rather than reading the whole string, so cost is linear in the
+ * command's length no matter how the two halves are spaced. `||` produces an
+ * empty part between them, and this deliberately still matches: `curl x || sh`
+ * runs a shell when the download fails, which is not meaningfully safer than
+ * running one when it succeeds.
+ */
+function pipesDownloadIntoShell(command) {
+    const heads = command.split('|').map((part) => parseSegments(part)[0]?.head);
+    const firstDownload = heads.findIndex((h) => h !== undefined && DOWNLOADERS.has(h));
+    if (firstDownload === -1)
+        return false;
+    return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
+}
+/** `dd … of=/dev/sda` — writing an image straight onto a block device. */
+function writesToDevice(command) {
+    return parseSegments(command).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+}
+/**
+ * `chown -R … /` — a recursive chown whose target is the filesystem root.
+ *
+ * The last non-flag argument is the target; `chown -R app:app /srv/app` is
+ * ordinary and stays allowed.
+ */
+function chownsRoot(command) {
+    return parseSegments(command).some(({ head, args }) => {
+        if (head !== 'chown' || !args.includes('-R'))
+            return false;
+        const positional = args.filter((a) => !a.startsWith('-'));
+        return positional[positional.length - 1] === '/';
+    });
+}
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({ label: String(re), test: (c) => re.test(c) })),
     {
         label: 'invoking a power-state command (shutdown, reboot, halt, poweroff) or eval',
         test: (command) => invokedWords(command).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
     },
+    {
+        label: 'piping a download into a shell (curl or wget into sh, bash or zsh)',
+        test: pipesDownloadIntoShell,
+    },
+    { label: 'dd writing to a block device (of=/dev/…)', test: writesToDevice },
+    { label: 'a recursive chown of the filesystem root', test: chownsRoot },
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {