ssh-mcp 2.4.1 → 2.5.0

package/README.md

@@ -3,7 +3,7 @@
 [![NPM Version](https://img.shields.io/npm/v/ssh-mcp)](https://www.npmjs.com/package/ssh-mcp)
 [![Downloads](https://img.shields.io/npm/dm/ssh-mcp)](https://www.npmjs.com/package/ssh-mcp)
 [![CI](https://github.com/tufantunc/ssh-mcp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/tufantunc/ssh-mcp/actions/workflows/ci.yml)
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/tufantunc/ssh-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/tufantunc/ssh-mcp)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tufantunc/ssh-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/tufantunc/ssh-mcp)
 [![codecov](https://codecov.io/gh/tufantunc/ssh-mcp/graph/badge.svg?branch=main)](https://codecov.io/gh/tufantunc/ssh-mcp)
 [![License](https://img.shields.io/github/license/tufantunc/ssh-mcp)](./LICENSE)
 [![GitHub issues](https://img.shields.io/github/issues/tufantunc/ssh-mcp)](https://github.com/tufantunc/ssh-mcp/issues)

package/build/config/schema.js

@@ -11,7 +11,78 @@ const commandClassSchema = z.enum(['read-only', 'safe', 'destructive', 'privileg
  * excluded alongside it rather than reasoned about case by case.
  */
 const RESERVED_BINDING_KEYS = ['__proto__', 'constructor', 'prototype'];
-const bindingKeySchema = z.string().min(1).refine((key) => !RESERVED_BINDING_KEYS.includes(key), { message: `Reserved name (${RESERVED_BINDING_KEYS.join(', ')}). Rename the role or tier.` });
+const RESERVED_KEY_MESSAGE = `Reserved name (${RESERVED_BINDING_KEYS.join(', ')}). Rename the role or tier.`;
+/** Only the length rule. The reserved-name rule lives in `checkReservedKeys` below. */
+const bindingKeySchema = z.string().min(1);
+/**
+ * How deep the walk goes: role -> tier -> classes.
+ *
+ * The schema descends exactly two levels whatever the input looks like, but this
+ * function follows the *data*, so without a bound it recurses as deep as the TOML
+ * nests. `smol-toml` parses ten thousand levels happily, and the resulting
+ * `RangeError` escapes `loadConfig` — `safeParse` throws rather than returning
+ * `{ success: false }`, and that call sits outside the loader's try/catch — so the
+ * operator got a stack trace where zod 3 printed a validation error.
+ */
+const MAX_BINDING_DEPTH = 2;
+/**
+ * The reserved-key check, run against the raw object before `z.record` sees it.
+ *
+ * `bindingKeySchema` alone stopped being enough at zod 4. Its record
+ * implementation never hands `__proto__` to the key schema — it drops the key and
+ * returns an object without it, so a config naming that role parsed *cleanly* and
+ * came out empty. Measured: `Object.keys` on the parsed TOML shows `__proto__`,
+ * `z.record` accepts, and the result has zero keys.
+ *
+ * zod 4 broke it in two separate ways, both measured. `z.record` never hands
+ * `__proto__` to the key schema — it drops the key and returns an object without it.
+ * And for the keys it does check, zod 4 replaces the key schema's message with its
+ * own `Invalid key in record`, so neither the reserved-name text nor `min(1)`'s
+ * reached the operator.
+ *
+ * The dropped key is not prototype pollution — zod 4 declines to write it at all,
+ * which is the safe half. What was lost is the refusal, and downstream catches it
+ * only when a profile uses the role: `resolvePolicyRules` throws for a role with no
+ * bindings, but a binding block no profile references was dropped in silence.
+ *
+ * So this owns both rules outright rather than layering over the key schema. The
+ * reserved-name `refine` came off `bindingKeySchema` at the same time — the pipe
+ * short-circuits, so it could never run, and calling it a second layer would have
+ * described something that was not there.
+ *
+ * `getOwnPropertyNames` and a property descriptor rather than `Object.keys` and a
+ * property read. Measured, neither changes the outcome for anything this can
+ * receive: `smol-toml` yields enumerable string keys, and an own `__proto__` data
+ * property shadows the prototype accessor, so even a direct read returns the key.
+ * They are kept because a descriptor cannot run a getter, and because whether a key
+ * is enumerable is the TOML parser's decision rather than ours.
+ */
+function checkReservedKeys(value, ctx, prefix = []) {
+    if (typeof value !== 'object' || value === null)
+        return;
+    if (prefix.length >= MAX_BINDING_DEPTH)
+        return;
+    for (const key of Object.getOwnPropertyNames(value)) {
+        // The path carries the ancestry, so a reserved tier names the role it sits under.
+        // Reporting only the leaf pointed the operator at a top-level role that was not in
+        // their file, which is the opposite of a refusal they can act on.
+        const path = [...prefix, key];
+        if (RESERVED_BINDING_KEYS.includes(key)) {
+            ctx.addIssue({ code: 'custom', message: RESERVED_KEY_MESSAGE, path });
+            // `continue` rather than `return`: a config with several bad names should hear
+            // about all of them, the way the policy engine's coherence check does.
+            continue;
+        }
+        if (key.length === 0) {
+            ctx.addIssue({ code: 'custom', message: 'Role and tier names cannot be empty.', path });
+            continue;
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor && typeof descriptor.value === 'object' && descriptor.value !== null) {
+            checkReservedKeys(descriptor.value, ctx, path);
+        }
+    }
+}
 export const defaultsSchema = z.object({
     defaultProfile: z.string().optional(),
     sessionMaxPerConnection: z.number().int().positive().default(5),
@@ -78,14 +149,17 @@ export const profileSchema = z.object({
  * code reads it, so accepting it here would document a key that does nothing.
  */
 export const policySchema = z.object({
-    roleBindings: z.record(bindingKeySchema, z.record(bindingKeySchema, z.array(commandClassSchema))).optional(),
+    roleBindings: z.unknown()
+        .superRefine(checkReservedKeys)
+        .pipe(z.record(bindingKeySchema, z.record(bindingKeySchema, z.array(commandClassSchema))))
+        .optional(),
     denylist: z.array(z.string()).optional(),
 }).strict();
 // .strict() on the root as well: without it an unknown section (a typo, or a
 // key from a newer version) parses cleanly and is dropped with no warning, so
 // the operator gets a clean startup and none of the behaviour they configured.
 export const configSchema = z.object({
-    defaults: defaultsSchema.default({}),
+    defaults: defaultsSchema.prefault({}),
     profiles: z.array(profileSchema).min(1),
     policy: policySchema.optional(),
 }).strict();

package/build/policy/classifier.js

@@ -543,6 +543,62 @@ export function extractBinary(command) {
     const parts = cmd.split(/\s+/);
     return parts[0] || '';
 }
+/**
+ * The word a segment will actually execute, read past anything that is not it.
+ *
+ * Distinct from `elevatedBinary`, which answers "does this ask for elevation".
+ * This answers "what is the name of the thing that runs", so it can be asked
+ * whether that name is knowable at all.
+ */
+function effectiveCommandWord(words) {
+    let i = 0;
+    while (i < words.length) {
+        const raw = words[i];
+        const word = stripPath(unquote(raw));
+        if (PRIVILEGE_PREFIXES.has(word) || EXEC_WRAPPERS.has(word)) {
+            i++;
+            while (i < words.length && words[i].startsWith('-')) {
+                const consumesValue = PREFIX_VALUE_FLAGS.has(words[i]);
+                i++;
+                if (consumesValue)
+                    i++;
+            }
+            continue;
+        }
+        if (ASSIGNMENT.test(raw) || raw.startsWith('-') || BARE_NUMERIC.test(raw)) {
+            i++;
+            continue;
+        }
+        return raw;
+    }
+    return null;
+}
+/**
+ * Whether any segment runs a command this process cannot name.
+ *
+ * The class — and with it the approval gate — is decided from the literal text of
+ * the command word. A word carrying `$` or a backtick is a name the shell resolves
+ * at run time, so `$S id` was classified as though `$S` were a binary, and came
+ * out `safe` (GHSA-fj9r-f47j-c73x).
+ *
+ * Resolving the variable is not the answer and cannot be: a session run keeps the
+ * caller's shell state, so `S=sudo` and `$S id` can arrive as two separate calls,
+ * and a variable exported in the target's own profile is never visible here at
+ * all. What is answerable is whether we know the name — and when we do not, saying
+ * so is the only honest class.
+ *
+ * Only the command word, never the arguments. `echo $HOME` names a command we know;
+ * promoting that would put a prompt on most ordinary shell usage.
+ */
+function hasUnnameableCommand(command) {
+    for (const raw of command.split(/[;&|\n]/)) {
+        const words = raw.trim().split(/\s+/).filter(Boolean);
+        const head = effectiveCommandWord(words);
+        if (head !== null && /[$`]/.test(head))
+            return true;
+    }
+    return false;
+}
 export function classifyCommand(command, depth = 0) {
     const trimmed = command.trim();
     const binary = extractBinary(trimmed);
@@ -588,6 +644,17 @@ export function classifyCommand(command, depth = 0) {
     if (isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };
     }
+    // Below this point every branch assumes the command word names something we
+    // recognised. When it is a variable expansion it names nothing we can check, so
+    // the allowlist must not be consulted — `$S` is not on it, and falling through to
+    // the default made an unknown command `safe`.
+    //
+    // `destructive` rather than `privileged`: this is "we cannot tell", not "this is
+    // root". It gates on approval instead of refusing outright, which keeps
+    // `$PREFIX/bin/tool` usable for a role that holds `destructive` on the tier.
+    if (hasUnnameableCommand(trimmed)) {
+        return { binary, fullCommand, class: 'destructive' };
+    }
     const twoWordPrefix = fullCommand.split(/\s+/).slice(0, 2).join(' ');
     if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)) {
         if (SHELL_CONTROL_CHARS.test(trimmed)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",
@@ -35,10 +35,7 @@
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "smol-toml": "^1.7.0",
     "ssh2": "^1.17.0",
-    "zod": "^3.25.28"
-  },
-  "overrides": {
-    "zod-to-json-schema": "3.24.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",