ssh-mcp 2.2.2 → 2.2.3

package/README.md

@@ -150,7 +150,7 @@ sessionMaxPerConnection = 5
 sessionIdleTimeoutMs = 600000       # 10min
 sessionBackgroundMaxMs = 3600000    # 1hr
 commandTimeoutMs = 60000
-commandMaxChars = 5000
+commandMaxChars = 5000              # 0 = unlimited, the config spelling of --maxChars=none
 commandMaxOutputBytes = 1048576     # 1MB
 connectionIdleReapMs = 900000       # 15min
 commandQuotaPerDay = 0              # 0 = unlimited; circuit breaker for runaway agents
@@ -177,6 +177,7 @@ cert = false                        # SSH CA cert auth — auto-detects keyRef-c
 sessionMaxPerConnection = 3         # per-profile override
 sessionIdleTimeoutMs = 300000       # stricter for prod
 commandQuotaPerDay = 200            # per-profile override
+maxChars = 2000                     # per-profile override; stricter for prod
 
 # Optional. Merged over the built-in role matrix; see "Policy Engine" below.
 # roleBindings is keyed by role and then by tier, so the block below changes
@@ -554,7 +555,7 @@ Secrets are **never** passed as CLI arguments.
 | `--workdir` | — | Quick start: Working directory for commands and sessions |
 | `--group` | prod | Quick start: Policy tier — `prod`, `staging` or `dev` |
 | `--timeout` | 60000 | Command timeout in ms |
-| `--maxChars` | 5000 | Max command length (`none` or `0` disables the limit) |
+| `--maxChars` | 5000 | Max command length (`none` or `0` disables the limit; in a config file the same setting is `commandMaxChars = 0`) |
 | `--sessionMax` | 5 | Max concurrent sessions per connection |
 | `--sessionTtl` | 600000 | Session idle timeout in ms |
 | `--transport` | stdio | `stdio` or `http` |

package/build/config/loader.js

@@ -67,6 +67,22 @@ export async function loadConfig(customPath) {
     }
     return normalizeConfig(result.data);
 }
+/**
+ * `0` means unlimited, the convention `commandQuotaPerDay` and
+ * `approvalGrantTtlMs` already use in this config file.
+ *
+ * It has to be *mapped* rather than merely permitted. `sanitizeCommand` tests
+ * `cleaned.length > maxChars`, so a literal `0` arriving there rejects every
+ * non-empty command with "Command is too long (max 0 characters)" — a worse
+ * failure than the one this spelling exists to fix.
+ *
+ * MAX_SAFE_INTEGER is the value `parseMaxChars` produces for `--maxChars=none`,
+ * so the flag and the config file hand the rest of the code an identical
+ * Profile rather than two spellings of uncapped (#123).
+ */
+function uncapZero(maxChars) {
+    return maxChars === 0 ? Number.MAX_SAFE_INTEGER : maxChars;
+}
 /**
  * Resolve every profile against [defaults]. Each of these keys is documented as
  * a default that profiles inherit, so all of them must cascade — a key that is
@@ -75,13 +91,23 @@ export async function loadConfig(customPath) {
  * downgrade, not just a papercut).
  */
 function normalizeConfig(raw) {
+    // commandMaxChars is mapped here as well as on the profile below, so no `0`
+    // survives anywhere in AppConfig. Leaving the raw value on `defaults` left one
+    // object carrying two encodings of "unlimited" — `profile.maxChars` as
+    // MAX_SAFE_INTEGER, `defaults.commandMaxChars` as 0 — with nothing in the
+    // types to tell them apart. index.ts:161 already copies straight across
+    // (`maxChars: defaults.commandMaxChars`), and was correct only because that
+    // path's value comes from parseMaxChars, which never returns 0. Correct by
+    // coincidence of another surface is not a property to leave standing when the
+    // wrong encoding rejects every non-empty command.
     const defaults = {
         ...raw.defaults,
+        commandMaxChars: uncapZero(raw.defaults.commandMaxChars),
     };
     const profiles = raw.profiles.map((p) => ({
         ...p,
         timeout: p.timeout ?? defaults.commandTimeoutMs,
-        maxChars: p.maxChars ?? defaults.commandMaxChars,
+        maxChars: uncapZero(p.maxChars ?? defaults.commandMaxChars),
         maxOutputBytes: p.maxOutputBytes ?? defaults.commandMaxOutputBytes,
         approvalPolicy: p.approvalPolicy ?? defaults.approvalMode,
         sessionMaxPerConnection: p.sessionMaxPerConnection ?? defaults.sessionMaxPerConnection,

package/build/config/schema.js

@@ -18,7 +18,10 @@ export const defaultsSchema = z.object({
     sessionIdleTimeoutMs: z.number().int().positive().default(600_000),
     sessionBackgroundMaxMs: z.number().int().positive().default(3_600_000),
     commandTimeoutMs: z.number().int().positive().default(60_000),
-    commandMaxChars: z.number().int().positive().default(5000),
+    // 0 = unlimited, matching `--maxChars=none` on the CLI. normalizeConfig()
+    // maps it to Number.MAX_SAFE_INTEGER so both surfaces hand the rest of the
+    // code an identical Profile.
+    commandMaxChars: z.number().int().nonnegative().default(5000),
     commandMaxOutputBytes: z.number().int().positive().default(1_048_576),
     connectionIdleReapMs: z.number().int().positive().default(900_000),
     // 0 = unlimited. A circuit breaker for runaway agents, not a rate limit.
@@ -50,7 +53,8 @@ export const profileSchema = z.object({
     // a schema-level .default() would make "user omitted it" indistinguishable
     // from "user set the default value", silently shadowing [defaults].
     timeout: z.number().int().positive().optional(),
-    maxChars: z.number().int().positive().optional(),
+    // 0 = unlimited, as in [defaults].commandMaxChars above.
+    maxChars: z.number().int().nonnegative().optional(),
     maxOutputBytes: z.number().int().positive().optional(),
     approvalPolicy: approvalModeSchema.optional(),
     sessionMaxPerConnection: z.number().int().positive().optional(),

package/build/policy/classifier.js

@@ -47,28 +47,38 @@ const READ_ONLY_ALLOWLIST = new Set([
  * purposes; see DESTRUCTIVE_DENYLIST below.
  */
 /*
- * Every `\s+` here is followed by a literal. Where a `.*` or `[^|]*` comes
- * next, the quantifier before it is a single `\s`: `\s+.*` lets both halves
- * claim the same run of spaces, so a non-matching command is retried from every
- * split and the match goes quadratic. sanitizeCommand caps commands at
- * profile.maxChars (5000 by default) long before this runs, which is what keeps
- * that cheap — but a policy check should not depend on a limit set three layers
- * away and configurable to any value.
+ * These are the patterns that stayed regexes, and every one of them is linear.
+ *
+ * The four that were not — `dd\s.*\bof=/dev/`, the two `curl|wget …\|\s*(sh…)`
+ * forms, and `chown\s+-R\s.*\s/\s*$` — are now segment checks below. An earlier
+ * comment here reasoned that ambiguity *within* a match was the only cost, and
+ * that was wrong: the engine also restarts at every offset where the cheap
+ * literal head matches, so a command built from `dd curl wget chown -R x `
+ * repeated ran at 4x per doubling. Measured on the real chain: 64 KB took
+ * 255 ms, 1 MB took 65 seconds of blocked event loop, and the stall lands in
+ * classifyCommand — before the approval gate and before the allow/deny
+ * decision, so no role, approval mode or readOnly flag protects against it.
+ *
+ * The old note said sanitizeCommand's maxChars cap kept this cheap, "but a
+ * policy check should not depend on a limit set three layers away and
+ * configurable to any value". Once a config file could say `commandMaxChars = 0`
+ * (#123) that limit went away, and the prediction came true. The rewrite below
+ * is what that sentence was asking for: the policy check is now safe on its own
+ * terms, whatever maxChars says.
+ *
+ * The existing cost test did not catch it because its seeds are runs of spaces,
+ * which never match the literal heads and so never trigger the restart.
  */
 const FORBIDDEN_PATTERNS = [
     /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
     /mkfs\./,
-    /dd\s.*\bof=\/dev\//,
     />\s*\/dev\/sd/,
     /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
-    /curl\s[^|]*\|\s*(sh|bash|zsh)/,
-    /wget\s[^|]*\|\s*(sh|bash|zsh)/,
     />\s*\/etc\/cron/,
     />\s*\/etc\/systemd/,
     />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
-    /\bchown\s+-R\s.*\s\/\s*$/,
 ];
 /**
  * Words that are forbidden when *invoked*, which the patterns above cannot
@@ -104,20 +114,12 @@ function stripPath(word) {
     const slash = word.lastIndexOf('/');
     return slash === -1 ? word : word.slice(slash + 1);
 }
-/**
- * The command words a shell would actually execute — the head of every
- * `;`/`&&`/`||`/`|`/newline-separated segment, past any privilege prefix, plus
- * the arguments of a multiplexer like `systemctl`.
- *
- * Pure string work: split, trim, set lookups. No quantifiers, so nothing here
- * can backtrack.
- */
-function invokedWords(command) {
-    const invoked = [];
-    for (const segment of command.split(/[;&|\n]/)) {
-        const words = segment.trim().split(/\s+/).filter(Boolean).map(stripPath);
+function parseSegments(command) {
+    const segments = [];
+    for (const raw of command.split(/[;&|\n]/)) {
+        const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
-        while (i < words.length && PRIVILEGE_PREFIXES.has(words[i])) {
+        while (i < words.length && PRIVILEGE_PREFIXES.has(stripPath(words[i]))) {
             i++;
             while (i < words.length && words[i].startsWith('-')) {
                 const consumesValue = PREFIX_VALUE_FLAGS.has(words[i]);
@@ -126,25 +128,73 @@ function invokedWords(command) {
                     i++;
             }
         }
-        const head = words[i];
-        if (!head)
-            continue;
+        if (i < words.length) {
+            segments.push({ head: stripPath(words[i]), args: words.slice(i + 1) });
+        }
+    }
+    return segments;
+}
+function invokedWords(command) {
+    const invoked = [];
+    for (const { head, args } of parseSegments(command)) {
         invoked.push(head);
         // `systemctl reboot` restarts the host. Reading a unit that happens to be
         // named after a power action is rare enough that erring towards refusal
         // here costs little.
         if (ACTION_MULTIPLEXERS.has(head)) {
-            invoked.push(...words.slice(i + 1).filter((w) => !w.startsWith('-')));
+            invoked.push(...args.filter((w) => !w.startsWith('-')).map(stripPath));
         }
     }
     return invoked;
 }
+const SHELLS = new Set(['sh', 'bash', 'zsh']);
+const DOWNLOADERS = new Set(['curl', 'wget']);
+/**
+ * A download piped into a shell.
+ *
+ * Split on `|` rather than reading the whole string, so cost is linear in the
+ * command's length no matter how the two halves are spaced. `||` produces an
+ * empty part between them, and this deliberately still matches: `curl x || sh`
+ * runs a shell when the download fails, which is not meaningfully safer than
+ * running one when it succeeds.
+ */
+function pipesDownloadIntoShell(command) {
+    const heads = command.split('|').map((part) => parseSegments(part)[0]?.head);
+    const firstDownload = heads.findIndex((h) => h !== undefined && DOWNLOADERS.has(h));
+    if (firstDownload === -1)
+        return false;
+    return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
+}
+/** `dd … of=/dev/sda` — writing an image straight onto a block device. */
+function writesToDevice(command) {
+    return parseSegments(command).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+}
+/**
+ * `chown -R … /` — a recursive chown whose target is the filesystem root.
+ *
+ * The last non-flag argument is the target; `chown -R app:app /srv/app` is
+ * ordinary and stays allowed.
+ */
+function chownsRoot(command) {
+    return parseSegments(command).some(({ head, args }) => {
+        if (head !== 'chown' || !args.includes('-R'))
+            return false;
+        const positional = args.filter((a) => !a.startsWith('-'));
+        return positional[positional.length - 1] === '/';
+    });
+}
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({ label: String(re), test: (c) => re.test(c) })),
     {
         label: 'invoking a power-state command (shutdown, reboot, halt, poweroff) or eval',
         test: (command) => invokedWords(command).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
     },
+    {
+        label: 'piping a download into a shell (curl or wget into sh, bash or zsh)',
+        test: pipesDownloadIntoShell,
+    },
+    { label: 'dd writing to a block device (of=/dev/…)', test: writesToDevice },
+    { label: 'a recursive chown of the filesystem root', test: chownsRoot },
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {