ssh-mcp 2.3.0 → 2.3.1

package/README.md

@@ -51,24 +51,27 @@ approvalPolicy = "auto"    # dev is permissive
 chmod 700 ~/.config/ssh-mcp && chmod 600 ~/.config/ssh-mcp/config.toml
 ```
 
-The server refuses to start if anyone but you can read the config, since it
-decides which hosts, roles and policy rules this server honours.
-
-On Linux and macOS that is the mode check above — the directory too, which is why
-`chmod 700` is in that command: `mkdir -p` under the default umask leaves it 0755. On Windows there are no mode
-bits, so it reads the ACL instead and requires that only your account, `SYSTEM`
-and `Administrators` hold access. A config under `%APPDATA%` inherits exactly
-that and needs nothing done to it. One created elsewhere does not — a file under
-`C:\` inherits read access for every local account and modify for every
-authenticated one — and the refusal names the two `icacls` commands that fix it,
-or, when the directory is a filesystem root or sits outside your user profile, leads with
-moving the config instead — it still prints the commands, but removing entries from a
-directory other accounts share is a judgement only you can make.
-
-If the ACL cannot be read at all, the server refuses rather than assuming the file is
-private, and `--allowUncheckedConfigAcl` loads it unverified. Two cases do not need the
-flag — `icacls` being absent from the machine, and the check running out of time — because
-both are statements about the machine rather than about the file. Each warns and loads.
+The config decides which hosts, roles and policy rules this server honours, so it checks
+that nobody but you can read it — and treats the two platforms differently, because the
+question has a much clearer answer on one of them.
+
+**Linux and macOS: enforced.** The mode check above, on the file *and* the directory —
+which is why `chmod 700` is in that command, since `mkdir -p` under the default umask
+leaves the directory 0755. The server refuses to start otherwise. "Only the owner" is
+unambiguous here and `chmod` is a one-line fix.
+
+**Windows: reported.** There are no mode bits, so it reads the ACL and tells you what it
+grants — a config under `%APPDATA%` inherits access for you, `SYSTEM` and `Administrators`
+and needs nothing done to it, while one created elsewhere does not: a file under `C:\`
+inherits read for every local account and modify for every authenticated one. The message
+names the two `icacls` commands that fix it, and then the config loads anyway.
+
+Advisory rather than enforced because enforced was tried first: 2.3.0 refused, and it
+blocked a config at the documented `%APPDATA%` location whose ACL carried a principal the
+allowlist had never seen ([#138](https://github.com/tufantunc/ssh-mcp/issues/138)). A check
+whose worst outcome is locking you out of your own config is not worth that. Pass
+`--strictConfigAcl` to refuse instead; under it, `--allowUncheckedConfigAcl` still loads a
+config whose ACL could not be determined at all.
 
 ### Exit statuses
 
@@ -602,6 +605,7 @@ Secrets are **never** passed as CLI arguments.
 | `--allowedHosts` | bind address + localhost | Comma-separated Host headers accepted by the DNS-rebinding guard |
 | `--insecureHostKey` | false | Disable host key verification (test only!) |
 | `--allowUncheckedConfigAcl` | false | Windows: load the config even if its ACL could not be read |
+| `--strictConfigAcl` | Windows: refuse to start on a broad or unreadable config ACL instead of reporting it |
 | `--disableApproval` | false | Skip the approval gate (quick start profile only) |
 | `--opaUrl` | — | OPA sidecar URL for external policy |
 | `--commandQuota` | 0 (off) | Max commands per rolling 24h per profile |

package/build/config/windows-acl.js

@@ -760,25 +760,30 @@ export async function assertPrivateOnWindows(filePath, opts = {}, inspect) {
         const verdict = await look(path);
         if (verdict.status === 'restricted')
             continue;
-        if (verdict.status === 'broad') {
-            const named = verdict.grants.map((g) => g.name).join(', ');
-            throw new OperatorError(`Config ${kind} ${path} is readable beyond its owner: access is granted to ${named}. ` +
-                'Required: this account, SYSTEM and Administrators only.\n' +
-                (isTightenable(path, kind) ? remediation(path, kind, verdict.grants) : relocation(path, kind, verdict.grants)));
-        }
-        if (verdict.status === 'no-dacl') {
-            throw new OperatorError(`Config ${kind} ${path} has no access control list at all, which on Windows means ` +
-                'full control for every account on the machine.\n' +
-                (isTightenable(path, kind) ? remediation(path, kind) : relocation(path, kind, [])));
+        if (verdict.status === 'broad' || verdict.status === 'no-dacl') {
+            const grants = verdict.status === 'broad' ? verdict.grants : [];
+            const what = verdict.status === 'broad'
+                ? `is readable beyond its owner: access is granted to ${grants.map((g) => g.name).join(', ')}. ` +
+                    'Required: this account, SYSTEM and Administrators only.'
+                : 'has no access control list at all, which on Windows means full control for ' +
+                    'every account on the machine.';
+            const message = `Config ${kind} ${path} ${what}\n` +
+                (isTightenable(path, kind) ? remediation(path, kind, grants) : relocation(path, kind, grants));
+            if (opts.strict)
+                throw new OperatorError(message);
+            // Advisory by default; see AclOptions.strict for why.
+            console.error(`Warning: ${message}`);
+            continue;
         }
         // status === 'unknown'
-        if (verdict.reason === 'tool-missing' || verdict.reason === 'timed-out' || opts.allowUnchecked) {
+        if (!opts.strict || verdict.reason === 'tool-missing' || verdict.reason === 'timed-out'
+            || opts.allowUnchecked) {
             report({ path, reason: verdict.reason, detail: verdict.detail });
             continue;
         }
         throw new OperatorError(`Config ${kind} ${path} could not be checked for access by other accounts ` +
             `(${verdict.reason}: ${verdict.detail}).\n` +
-            'This is refused rather than assumed safe, because the config decides which hosts, ' +
+            'Refused because --strictConfigAcl was given, and the config decides which hosts, ' +
             'roles and policy rules this server honours.\n' +
             'Either fix the cause, move the config under %APPDATA%\\ssh-mcp, or pass ' +
             '--allowUncheckedConfigAcl to load it unverified.');

package/build/index.js

@@ -130,6 +130,7 @@ async function buildAppConfig(argv) {
     // the audit store as well needs an AuditRecord variant for a startup event — that type
     // is hash-chained and tamper-evident, so it is its own change, and it is queued.
     const aclOpts = {
+        strict: flagEnabled(argv, 'strictConfigAcl'),
         allowUnchecked: flagEnabled(argv, 'allowUncheckedConfigAcl'),
         onUnverified: (e) => {
             unverified.push(e);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {