ssh-mcp 2.2.2 → 2.2.4

package/README.md

@@ -150,7 +150,7 @@ sessionMaxPerConnection = 5
 sessionIdleTimeoutMs = 600000       # 10min
 sessionBackgroundMaxMs = 3600000    # 1hr
 commandTimeoutMs = 60000
-commandMaxChars = 5000
+commandMaxChars = 5000              # 0 = unlimited, the config spelling of --maxChars=none
 commandMaxOutputBytes = 1048576     # 1MB
 connectionIdleReapMs = 900000       # 15min
 commandQuotaPerDay = 0              # 0 = unlimited; circuit breaker for runaway agents
@@ -177,6 +177,7 @@ cert = false                        # SSH CA cert auth — auto-detects keyRef-c
 sessionMaxPerConnection = 3         # per-profile override
 sessionIdleTimeoutMs = 300000       # stricter for prod
 commandQuotaPerDay = 200            # per-profile override
+maxChars = 2000                     # per-profile override; stricter for prod
 
 # Optional. Merged over the built-in role matrix; see "Policy Engine" below.
 # roleBindings is keyed by role and then by tier, so the block below changes
@@ -554,7 +555,7 @@ Secrets are **never** passed as CLI arguments.
 | `--workdir` | — | Quick start: Working directory for commands and sessions |
 | `--group` | prod | Quick start: Policy tier — `prod`, `staging` or `dev` |
 | `--timeout` | 60000 | Command timeout in ms |
-| `--maxChars` | 5000 | Max command length (`none` or `0` disables the limit) |
+| `--maxChars` | 5000 | Max command length (`none` or `0` disables the limit; in a config file the same setting is `commandMaxChars = 0`) |
 | `--sessionMax` | 5 | Max concurrent sessions per connection |
 | `--sessionTtl` | 600000 | Session idle timeout in ms |
 | `--transport` | stdio | `stdio` or `http` |

package/build/config/loader.js

@@ -67,6 +67,22 @@ export async function loadConfig(customPath) {
     }
     return normalizeConfig(result.data);
 }
+/**
+ * `0` means unlimited, the convention `commandQuotaPerDay` and
+ * `approvalGrantTtlMs` already use in this config file.
+ *
+ * It has to be *mapped* rather than merely permitted. `sanitizeCommand` tests
+ * `cleaned.length > maxChars`, so a literal `0` arriving there rejects every
+ * non-empty command with "Command is too long (max 0 characters)" — a worse
+ * failure than the one this spelling exists to fix.
+ *
+ * MAX_SAFE_INTEGER is the value `parseMaxChars` produces for `--maxChars=none`,
+ * so the flag and the config file hand the rest of the code an identical
+ * Profile rather than two spellings of uncapped (#123).
+ */
+function uncapZero(maxChars) {
+    return maxChars === 0 ? Number.MAX_SAFE_INTEGER : maxChars;
+}
 /**
  * Resolve every profile against [defaults]. Each of these keys is documented as
  * a default that profiles inherit, so all of them must cascade — a key that is
@@ -75,13 +91,23 @@ export async function loadConfig(customPath) {
  * downgrade, not just a papercut).
  */
 function normalizeConfig(raw) {
+    // commandMaxChars is mapped here as well as on the profile below, so no `0`
+    // survives anywhere in AppConfig. Leaving the raw value on `defaults` left one
+    // object carrying two encodings of "unlimited" — `profile.maxChars` as
+    // MAX_SAFE_INTEGER, `defaults.commandMaxChars` as 0 — with nothing in the
+    // types to tell them apart. index.ts:161 already copies straight across
+    // (`maxChars: defaults.commandMaxChars`), and was correct only because that
+    // path's value comes from parseMaxChars, which never returns 0. Correct by
+    // coincidence of another surface is not a property to leave standing when the
+    // wrong encoding rejects every non-empty command.
     const defaults = {
         ...raw.defaults,
+        commandMaxChars: uncapZero(raw.defaults.commandMaxChars),
     };
     const profiles = raw.profiles.map((p) => ({
         ...p,
         timeout: p.timeout ?? defaults.commandTimeoutMs,
-        maxChars: p.maxChars ?? defaults.commandMaxChars,
+        maxChars: uncapZero(p.maxChars ?? defaults.commandMaxChars),
         maxOutputBytes: p.maxOutputBytes ?? defaults.commandMaxOutputBytes,
         approvalPolicy: p.approvalPolicy ?? defaults.approvalMode,
         sessionMaxPerConnection: p.sessionMaxPerConnection ?? defaults.sessionMaxPerConnection,

package/build/config/schema.js

@@ -18,7 +18,10 @@ export const defaultsSchema = z.object({
     sessionIdleTimeoutMs: z.number().int().positive().default(600_000),
     sessionBackgroundMaxMs: z.number().int().positive().default(3_600_000),
     commandTimeoutMs: z.number().int().positive().default(60_000),
-    commandMaxChars: z.number().int().positive().default(5000),
+    // 0 = unlimited, matching `--maxChars=none` on the CLI. normalizeConfig()
+    // maps it to Number.MAX_SAFE_INTEGER so both surfaces hand the rest of the
+    // code an identical Profile.
+    commandMaxChars: z.number().int().nonnegative().default(5000),
     commandMaxOutputBytes: z.number().int().positive().default(1_048_576),
     connectionIdleReapMs: z.number().int().positive().default(900_000),
     // 0 = unlimited. A circuit breaker for runaway agents, not a rate limit.
@@ -50,7 +53,8 @@ export const profileSchema = z.object({
     // a schema-level .default() would make "user omitted it" indistinguishable
     // from "user set the default value", silently shadowing [defaults].
     timeout: z.number().int().positive().optional(),
-    maxChars: z.number().int().positive().optional(),
+    // 0 = unlimited, as in [defaults].commandMaxChars above.
+    maxChars: z.number().int().nonnegative().optional(),
     maxOutputBytes: z.number().int().positive().optional(),
     approvalPolicy: approvalModeSchema.optional(),
     sessionMaxPerConnection: z.number().int().positive().optional(),

package/build/policy/classifier.js

@@ -19,7 +19,7 @@ const SHELL_CONTROL_CHARS = /[;&|<>`$(){}\n\r]/;
 const READ_ONLY_ALLOWLIST = new Set([
     'ls', 'cat', 'grep', 'find', 'stat', 'df', 'du', 'head', 'tail', 'wc',
     'ps', 'uname', 'uptime', 'hostname', 'id', 'who', 'whoami', 'date',
-    'env', 'printenv', 'pwd', 'echo', 'printf', 'test', 'true', 'false',
+    'printenv', 'pwd', 'echo', 'printf', 'test', 'true', 'false',
     'which', 'whereis', 'file', 'readlink', 'realpath', 'basename', 'dirname',
     'seq', 'sort', 'uniq', 'cut', 'tr', 'diff', 'comm',
     'systemctl status', 'journalctl', 'docker ps', 'docker logs', 'docker inspect',
@@ -28,6 +28,15 @@ const READ_ONLY_ALLOWLIST = new Set([
     'host', 'ping', 'traceroute', 'git status', 'git log',
     'git diff', 'git branch', 'git show', 'git remote',
 ]);
+// Deliberately NOT read-only: `env`, because it is an exec wrapper. `env <cmd>`
+// runs <cmd>, so allowlisting the name `env` vouched for a command the
+// classifier never looked at — `env sudo rm -f /etc/passwd` classified
+// `read-only` and ran on a profile whose whole contract is that it cannot
+// write. It carries no shell metacharacter, so the SHELL_CONTROL_CHARS gate
+// below did not catch it either. Falls through to `safe`, so run-command can
+// still reach it under policy; a bare `env` that only prints the environment
+// loses read-only status with it, which is the price of a name-based allowlist.
+//
 // Deliberately NOT read-only: `curl` and `wget` fetch arbitrary URLs (SSRF to
 // cloud metadata / internal services), post local files to a remote host
 // (`curl -d @/etc/passwd`), and write remote files (`curl -o`, `wget -O`) —
@@ -47,28 +56,38 @@ const READ_ONLY_ALLOWLIST = new Set([
  * purposes; see DESTRUCTIVE_DENYLIST below.
  */
 /*
- * Every `\s+` here is followed by a literal. Where a `.*` or `[^|]*` comes
- * next, the quantifier before it is a single `\s`: `\s+.*` lets both halves
- * claim the same run of spaces, so a non-matching command is retried from every
- * split and the match goes quadratic. sanitizeCommand caps commands at
- * profile.maxChars (5000 by default) long before this runs, which is what keeps
- * that cheap — but a policy check should not depend on a limit set three layers
- * away and configurable to any value.
+ * These are the patterns that stayed regexes, and every one of them is linear.
+ *
+ * The four that were not — `dd\s.*\bof=/dev/`, the two `curl|wget …\|\s*(sh…)`
+ * forms, and `chown\s+-R\s.*\s/\s*$` — are now segment checks below. An earlier
+ * comment here reasoned that ambiguity *within* a match was the only cost, and
+ * that was wrong: the engine also restarts at every offset where the cheap
+ * literal head matches, so a command built from `dd curl wget chown -R x `
+ * repeated ran at 4x per doubling. Measured on the real chain: 64 KB took
+ * 255 ms, 1 MB took 65 seconds of blocked event loop, and the stall lands in
+ * classifyCommand — before the approval gate and before the allow/deny
+ * decision, so no role, approval mode or readOnly flag protects against it.
+ *
+ * The old note said sanitizeCommand's maxChars cap kept this cheap, "but a
+ * policy check should not depend on a limit set three layers away and
+ * configurable to any value". Once a config file could say `commandMaxChars = 0`
+ * (#123) that limit went away, and the prediction came true. The rewrite below
+ * is what that sentence was asking for: the policy check is now safe on its own
+ * terms, whatever maxChars says.
+ *
+ * The existing cost test did not catch it because its seeds are runs of spaces,
+ * which never match the literal heads and so never trigger the restart.
  */
 const FORBIDDEN_PATTERNS = [
     /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
     /mkfs\./,
-    /dd\s.*\bof=\/dev\//,
     />\s*\/dev\/sd/,
     /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
-    /curl\s[^|]*\|\s*(sh|bash|zsh)/,
-    /wget\s[^|]*\|\s*(sh|bash|zsh)/,
     />\s*\/etc\/cron/,
     />\s*\/etc\/systemd/,
     />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
-    /\bchown\s+-R\s.*\s\/\s*$/,
 ];
 /**
  * Words that are forbidden when *invoked*, which the patterns above cannot
@@ -89,6 +108,50 @@ const FORBIDDEN_INVOCATIONS = new Set(['shutdown', 'reboot', 'halt', 'poweroff',
 /** Binaries that take the dangerous action as an argument: `systemctl reboot`. */
 const ACTION_MULTIPLEXERS = new Set(['systemctl', 'init', 'telinit']);
 const PRIVILEGE_PREFIXES = new Set(['sudo', 'su', 'doas', 'pkexec']);
+/**
+ * Binaries whose job is to run another command.
+ *
+ * The allowlist and the privilege check both name a binary, so a wrapper hides
+ * whatever it wraps: `env sudo id` was classified by the name `env`. These are
+ * stepped over when deciding whether a segment elevates, so the check sees the
+ * command that will actually run.
+ *
+ * `env` is the one that was also allowlisted, and it has been removed from
+ * READ_ONLY_ALLOWLIST above. The rest were never read-only, so before this they
+ * hid elevation rather than granting it — `nohup sudo systemctl stop nginx`
+ * classified `safe`, which the default bindings grant to admin and operator on
+ * every tier.
+ */
+const EXEC_WRAPPERS = new Set([
+    'env', 'nohup', 'nice', 'ionice', 'command', 'exec', 'setsid', 'stdbuf',
+    'timeout', 'chrt', 'taskset', 'xargs', 'watch',
+]);
+/**
+ * Arguments that turn an allowlisted binary into one that writes or executes.
+ *
+ * The allowlist vouches for a name; these are the flags that make the name a
+ * lie. `find /var/www -delete` removes a directory tree and `find / -exec sudo
+ * id +` runs a command as root, and both classified `read-only` — the `-exec …
+ * \;` form only escaped because `;` happens to be a shell metacharacter, while
+ * the `+` terminator carries none.
+ */
+const DISQUALIFYING_ARGS = {
+    find: /^-(exec|execdir|ok|okdir|delete|fprintf?|fls)$/,
+};
+/** A leading `NAME=value`, which a shell treats as an assignment, not a command. */
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+/** `timeout 5s`, `nice 10` — a bare argument some wrappers take before the command. */
+const BARE_NUMERIC = /^\d+(\.\d+)?[smhd]?$/;
+/**
+ * Remove the quoting a shell would remove before looking up a command.
+ *
+ * `\sudo`, `'sudo'` and `"sudo"` all execute sudo — the backslash only
+ * suppresses alias expansion — but a verbatim string comparison sees three
+ * different words. Without this, a one-character edit walks around the check.
+ */
+function unquote(word) {
+    return word.replace(/^(['"])(.*)\1$/, '$2').replace(/\\(.)/g, '$1');
+}
 /**
  * Privilege-prefix flags that consume the next argument, so `sudo -u root
  * reboot` is not read as invoking `root`. Enumerable because it is one tool's
@@ -104,20 +167,12 @@ function stripPath(word) {
     const slash = word.lastIndexOf('/');
     return slash === -1 ? word : word.slice(slash + 1);
 }
-/**
- * The command words a shell would actually execute — the head of every
- * `;`/`&&`/`||`/`|`/newline-separated segment, past any privilege prefix, plus
- * the arguments of a multiplexer like `systemctl`.
- *
- * Pure string work: split, trim, set lookups. No quantifiers, so nothing here
- * can backtrack.
- */
-function invokedWords(command) {
-    const invoked = [];
-    for (const segment of command.split(/[;&|\n]/)) {
-        const words = segment.trim().split(/\s+/).filter(Boolean).map(stripPath);
+function parseSegments(command) {
+    const segments = [];
+    for (const raw of command.split(/[;&|\n]/)) {
+        const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
-        while (i < words.length && PRIVILEGE_PREFIXES.has(words[i])) {
+        while (i < words.length && PRIVILEGE_PREFIXES.has(stripPath(words[i]))) {
             i++;
             while (i < words.length && words[i].startsWith('-')) {
                 const consumesValue = PREFIX_VALUE_FLAGS.has(words[i]);
@@ -126,25 +181,124 @@ function invokedWords(command) {
                     i++;
             }
         }
-        const head = words[i];
-        if (!head)
+        if (i < words.length) {
+            segments.push({ head: stripPath(words[i]), args: words.slice(i + 1) });
+        }
+    }
+    return segments;
+}
+/**
+ * Whether a segment asks for elevation, reading past anything that is not yet
+ * the command.
+ *
+ * A shell resolves the command word after assignments, and a wrapper runs what
+ * follows it, so all of these execute sudo while naming something else first:
+ *
+ *   env sudo id            nohup sudo id         timeout 5 sudo id
+ *   FOO=1 sudo id          nice -n 10 sudo id    command sudo id
+ *
+ * The scan walks left to right and stops at the first word that is a real
+ * command. Reaching a privilege prefix before that is elevation; reaching
+ * anything else is not, which is what keeps `grep sudo /var/log/auth.log` a
+ * mention rather than an invocation.
+ */
+function segmentElevates(words) {
+    for (const raw of words) {
+        const word = stripPath(unquote(raw));
+        if (PRIVILEGE_PREFIXES.has(word))
+            return true;
+        if (ASSIGNMENT.test(raw))
+            continue;
+        if (EXEC_WRAPPERS.has(word))
             continue;
+        if (raw.startsWith('-'))
+            continue;
+        if (BARE_NUMERIC.test(raw))
+            continue;
+        return false;
+    }
+    return false;
+}
+/**
+ * Does this command elevate anywhere a shell would act on it?
+ *
+ * Replaces four `^`-anchored regexes that only saw a *leading* prefix. Elevation
+ * behind a wrapper, behind an assignment, or after a separator all reached root
+ * with the command classified `safe` or `read-only`.
+ */
+function elevates(command) {
+    return command
+        .split(/[;&|\n]/)
+        .some((segment) => segmentElevates(segment.trim().split(/\s+/).filter(Boolean)));
+}
+/** An allowlisted binary carrying a flag that makes it write or execute. */
+function hasDisqualifyingArgs(command) {
+    return parseSegments(command).some(({ head, args }) => {
+        const rule = DISQUALIFYING_ARGS[head];
+        return rule !== undefined && args.some((arg) => rule.test(arg));
+    });
+}
+function invokedWords(command) {
+    const invoked = [];
+    for (const { head, args } of parseSegments(command)) {
         invoked.push(head);
         // `systemctl reboot` restarts the host. Reading a unit that happens to be
         // named after a power action is rare enough that erring towards refusal
         // here costs little.
         if (ACTION_MULTIPLEXERS.has(head)) {
-            invoked.push(...words.slice(i + 1).filter((w) => !w.startsWith('-')));
+            invoked.push(...args.filter((w) => !w.startsWith('-')).map(stripPath));
         }
     }
     return invoked;
 }
+const SHELLS = new Set(['sh', 'bash', 'zsh']);
+const DOWNLOADERS = new Set(['curl', 'wget']);
+/**
+ * A download piped into a shell.
+ *
+ * Split on `|` rather than reading the whole string, so cost is linear in the
+ * command's length no matter how the two halves are spaced. `||` produces an
+ * empty part between them, and this deliberately still matches: `curl x || sh`
+ * runs a shell when the download fails, which is not meaningfully safer than
+ * running one when it succeeds.
+ */
+function pipesDownloadIntoShell(command) {
+    const heads = command.split('|').map((part) => parseSegments(part)[0]?.head);
+    const firstDownload = heads.findIndex((h) => h !== undefined && DOWNLOADERS.has(h));
+    if (firstDownload === -1)
+        return false;
+    return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
+}
+/** `dd … of=/dev/sda` — writing an image straight onto a block device. */
+function writesToDevice(command) {
+    return parseSegments(command).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+}
+/**
+ * `chown -R … /` — a recursive chown whose target is the filesystem root.
+ *
+ * The last non-flag argument is the target; `chown -R app:app /srv/app` is
+ * ordinary and stays allowed.
+ */
+function chownsRoot(command) {
+    return parseSegments(command).some(({ head, args }) => {
+        if (head !== 'chown' || !args.includes('-R'))
+            return false;
+        const positional = args.filter((a) => !a.startsWith('-'));
+        return positional[positional.length - 1] === '/';
+    });
+}
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({ label: String(re), test: (c) => re.test(c) })),
     {
         label: 'invoking a power-state command (shutdown, reboot, halt, poweroff) or eval',
         test: (command) => invokedWords(command).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
     },
+    {
+        label: 'piping a download into a shell (curl or wget into sh, bash or zsh)',
+        test: pipesDownloadIntoShell,
+    },
+    { label: 'dd writing to a block device (of=/dev/…)', test: writesToDevice },
+    { label: 'a recursive chown of the filesystem root', test: chownsRoot },
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:
@@ -180,7 +334,7 @@ const DESTRUCTIVE_PATTERNS = [
 function isDestructive(command) {
     return isForbidden(command) || DESTRUCTIVE_PATTERNS.some((re) => re.test(command));
 }
-const PRIVILEGED_INDICATORS = [
+const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*sudo\b/,
     /^\s*su\b/,
     /^\s*doas\b/,
@@ -188,7 +342,7 @@ const PRIVILEGED_INDICATORS = [
 ];
 export function extractBinary(command) {
     let cmd = command.trim();
-    for (const prefix of PRIVILEGED_INDICATORS) {
+    for (const prefix of LEADING_PRIVILEGE_PREFIXES) {
         cmd = cmd.replace(prefix, '').trim();
     }
     if (cmd.startsWith('-c ')) {
@@ -201,11 +355,10 @@ export function classifyCommand(command) {
     const trimmed = command.trim();
     const binary = extractBinary(trimmed);
     const fullCommand = trimmed;
-    const isPrivileged = PRIVILEGED_INDICATORS.some((re) => re.test(trimmed));
-    if (isPrivileged) {
+    if (elevates(trimmed)) {
         return { binary, fullCommand, class: 'privileged' };
     }
-    if (isDestructive(trimmed)) {
+    if (isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };
     }
     const twoWordPrefix = fullCommand.split(/\s+/).slice(0, 2).join(' ');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.2.2",
+  "version": "2.2.4",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {