ssh-mcp 2.2.4 → 2.2.6

package/build/config/credential-resolver.js

@@ -100,8 +100,20 @@ export async function resolveCredentials(profile) {
         }
     }
     if (!creds.password && !creds.privateKey && !creds.agentSocket) {
-        throw new Error(`No credentials resolved for profile "${profile.name}". ` +
-            `Available methods: SSH agent (SSH_AUTH_SOCK), OS keychain (auth=keychain), env vars (SSH_MCP_PASSWORD), or key file (SSH_MCP_KEY).`);
+        // Naming the method the profile asked for, rather than listing all four,
+        // is the difference between "fix the one you chose" and "pick whichever is
+        // easiest" — and the easiest is a plaintext password in the environment.
+        const asked = profile.auth;
+        const why = {
+            agent: 'SSH_AUTH_SOCK is unset or the agent holds no usable key',
+            key: `no key was read${profile.keyRef ? ` from ${profile.keyRef}` : ' — keyRef is not set on the profile'}`,
+            keychain: `the OS keychain returned nothing${profile.keychainEntry ? ` for "${profile.keychainEntry}"` : ' — keychainEntry is not set on the profile'}`,
+            password: `SSH_MCP_PASSWORD and SSH_MCP_${profile.name.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_PASSWORD are both unset`,
+        };
+        throw new Error(`No credentials resolved for profile "${profile.name}", which asks for auth = "${asked}": ${why[asked] ?? 'nothing was found'}.\n` +
+            'Fix that method rather than switching to another if you can — the fallbacks are ordered by how much ' +
+            'they expose. In order: an SSH agent (nothing on disk), an encrypted key with SSH_MCP_KEY, the OS ' +
+            `keychain, and last a password in SSH_MCP_PASSWORD, which is readable by every process running as you.`);
     }
     return creds;
 }

package/build/policy/classifier.js

@@ -107,7 +107,27 @@ const FORBIDDEN_PATTERNS = [
 const FORBIDDEN_INVOCATIONS = new Set(['shutdown', 'reboot', 'halt', 'poweroff', 'eval']);
 /** Binaries that take the dangerous action as an argument: `systemctl reboot`. */
 const ACTION_MULTIPLEXERS = new Set(['systemctl', 'init', 'telinit']);
-const PRIVILEGE_PREFIXES = new Set(['sudo', 'su', 'doas', 'pkexec']);
+/**
+ * Binaries that run the rest of the command as another user.
+ *
+ * The list is explicit rather than a pattern, because a pattern cannot tell
+ * `sudoedit` — which edits a file and is not elevation — from `sudo-rs`, which
+ * is sudo. It has to be maintained by hand as new implementations appear; the
+ * cost of missing one is that its commands classify `safe`.
+ *
+ * The last five were added in 2.2.5 (#132). Until 2.2.4 the check was
+ * `/^\s*su\b/` and friends, and `\b` matched between `su` and the hyphen, so
+ * `su-exec` and `sudo-rs` were caught — by accident of the regex, not by
+ * intent. Moving to exact membership dropped them, which narrowed a security
+ * control inside a security release. `gosu` and `run0` were never caught by
+ * either form.
+ */
+const PRIVILEGE_PREFIXES = new Set([
+    'sudo', 'su', 'doas', 'pkexec',
+    // BusyBox/Alpine, Docker entrypoints, the Rust sudo now default on some
+    // distributions, systemd's replacement, and the Solaris/illumos spelling.
+    'su-exec', 'gosu', 'sudo-rs', 'run0', 'pfexec',
+]);
 /**
  * Binaries whose job is to run another command.
  *
@@ -202,22 +222,57 @@ function parseSegments(command) {
  * anything else is not, which is what keeps `grep sudo /var/log/auth.log` a
  * mention rather than an invocation.
  */
-function segmentElevates(words) {
-    for (const raw of words) {
+function elevatedBinary(words) {
+    let i = 0;
+    let prefix = null;
+    while (i < words.length) {
+        const raw = words[i];
         const word = stripPath(unquote(raw));
-        if (PRIVILEGE_PREFIXES.has(word))
-            return true;
-        if (ASSIGNMENT.test(raw))
-            continue;
-        if (EXEC_WRAPPERS.has(word))
-            continue;
-        if (raw.startsWith('-'))
+        if (PRIVILEGE_PREFIXES.has(word)) {
+            prefix ??= word;
+            i++;
+            // The prefix's own options, some of which swallow the next word.
+            while (i < words.length && words[i].startsWith('-')) {
+                const consumesValue = PREFIX_VALUE_FLAGS.has(words[i]);
+                i++;
+                if (consumesValue)
+                    i++;
+            }
             continue;
-        if (BARE_NUMERIC.test(raw))
+        }
+        // Words that are not yet the command: an assignment, a wrapper, an option,
+        // or the bare number `timeout`/`nice` take before theirs.
+        if (ASSIGNMENT.test(raw) || EXEC_WRAPPERS.has(word)
+            || raw.startsWith('-') || BARE_NUMERIC.test(raw)) {
+            i++;
             continue;
-        return false;
+        }
+        // A real command. Before any prefix it means the segment does not elevate —
+        // which is what keeps `grep sudo /var/log/auth.log` a mention. After one, it
+        // is what actually runs as root.
+        return prefix === null ? null : word;
+    }
+    // `sudo`, or `sudo -u root`, with nothing after it: the prefix is all there is
+    // to name.
+    return prefix;
+}
+/**
+ * The binary this command runs under elevation, or null if it runs none.
+ *
+ * Returning the name rather than a boolean is what lets `ParsedCommand.binary`
+ * describe the same command the class does. Until 2.2.4 a `privileged` class
+ * implied a leading prefix, so the anchored `extractBinary` always named the
+ * elevated binary; once elevation could be found in any segment that stopped
+ * holding, and `echo hi; sudo id` recorded `binary: "echo"` against a
+ * privileged decision — in the audit log, the OTel span and OPA's input (#134).
+ */
+function elevatedBinaryOf(command) {
+    for (const segment of command.split(/[;&|\n]/)) {
+        const found = elevatedBinary(segment.trim().split(/\s+/).filter(Boolean));
+        if (found !== null)
+            return found;
     }
-    return false;
+    return null;
 }
 /**
  * Does this command elevate anywhere a shell would act on it?
@@ -226,11 +281,6 @@ function segmentElevates(words) {
  * behind a wrapper, behind an assignment, or after a separator all reached root
  * with the command classified `safe` or `read-only`.
  */
-function elevates(command) {
-    return command
-        .split(/[;&|\n]/)
-        .some((segment) => segmentElevates(segment.trim().split(/\s+/).filter(Boolean)));
-}
 /** An allowlisted binary carrying a flag that makes it write or execute. */
 function hasDisqualifyingArgs(command) {
     return parseSegments(command).some(({ head, args }) => {
@@ -355,8 +405,12 @@ export function classifyCommand(command) {
     const trimmed = command.trim();
     const binary = extractBinary(trimmed);
     const fullCommand = trimmed;
-    if (elevates(trimmed)) {
-        return { binary, fullCommand, class: 'privileged' };
+    // `binary` names the subject of the class. For everything below it is the
+    // leading command; here it is the one that runs as root, which are the same
+    // thing only when the prefix leads.
+    const elevated = elevatedBinaryOf(trimmed);
+    if (elevated !== null) {
+        return { binary: elevated, fullCommand, class: 'privileged' };
     }
     if (isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };

package/build/ssh/host-key.js

@@ -14,7 +14,19 @@ export function verifyHostKey(host, port, fingerprint, knownHosts, mode) {
     const stored = knownHosts.get(key);
     if (stored) {
         if (stored !== fingerprint) {
-            throw new Error(`HOST_KEY_MISMATCH: ${host}:${port} key changed (expected ${stored.slice(0, 20)}..., got ${fingerprint.slice(0, 20)}...)`);
+            // Two very different things produce this, and the message has to let the
+            // reader tell them apart — otherwise the reflex is --insecureHostKey,
+            // which turns the check off for every host rather than for this one.
+            throw new Error(`HOST_KEY_MISMATCH: the key presented by ${host}:${port} is not the one seen before.\n` +
+                `  expected ${stored}\n` +
+                `  received ${fingerprint}\n` +
+                'Either the server was rebuilt, reinstalled or had its address reused — in which case the new key is ' +
+                'genuine — or something is intercepting this connection, which is what this check exists to catch. ' +
+                'Nothing here can tell those apart; confirm the fingerprint out of band, from the host itself ' +
+                '(`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub` on the server) or from whoever rebuilt it.\n' +
+                'If it matches, pin it with trustedHostKey on the profile. Do not reach for --insecureHostKey to get ' +
+                'past this: it disables verification for every host and every future connection, including the case ' +
+                'this message is warning you about.');
         }
         return true;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.2.4",
+  "version": "2.2.6",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {