ssh-mcp 2.5.0 → 2.6.0

package/README.md

@@ -152,8 +152,8 @@ claude mcp add --transport stdio ssh-mcp -- ssh-mcp
 | `close-session` | Close a session. A background session's command is signalled (INT/TERM/KILL) before its channel is dropped | — | ✅ |
 | `read-session-output` | Read output from background sessions (e.g., `tail -f`) | ✅ | — |
 | `read-command` | Execute allowlisted read-only commands (`ls`, `cat`, `grep`, ...) | ✅ | — |
-| `run-command` | Execute arbitrary commands (destructive ones need approval) | — | — |
-| `privileged-command` | Execute with sudo (always requires approval) | — | ✅ |
+| `run-command` | Execute arbitrary commands (destructive/privileged need approval, unless `approvalPolicy = "auto"`) | — | — |
+| `privileged-command` | Execute with sudo (needs approval, unless `approvalPolicy = "auto"`) | — | ✅ |
 | `sftp-upload` | Upload a file via SFTP | — | ✅ |
 | `sftp-download` | Download a file via SFTP | ✅ | — |
 | `signal-process` | Send INT/TERM/KILL to a remote PID | — | ✅ |
@@ -422,7 +422,13 @@ denylist; an invalid pattern fails at startup rather than degrading silently.
 ### Approval Modes
 
 - `auto` — no prompts (dev only!)
-- `ask-destructive` — prompt for destructive/privileged (default)
+- `ask-destructive` — prompt for destructive/privileged (default). Narrower than it sounds:
+  outside the never-allowed list, `destructive` is one `rm -rf /path` pattern, `find` with a
+  write/exec flag, an unresolvable command word, a program handed to an interpreter this
+  server cannot read (`python3 -c`, `perl -e`, `node -e`, a program arriving on a pipe —
+  but not `awk`, whose program is not read), and `sftp-upload`/interactive `open-session` — elevation classifies `privileged`, which also
+  prompts. Ordinary writes, service control and signals do not. See
+  [SECURITY.md](./SECURITY.md) before relying on this in production.
 - `ask-all` — prompt for every command
 - `deny` — reject destructive/privileged commands outright (no prompt)
 
@@ -566,7 +572,7 @@ level number.
 ### Safe Defaults
 
 - **Non-root** user in all examples
-- **TOFU** host key verification (accept on first connect, verify after)
+- **TOFU** host key verification (accept on first connect, verify after — within one process; see [SECURITY.md](./SECURITY.md#host-key-trust-does-not-survive-a-restart))
 - **RFC 9142** algorithm allow-list (no SHA-1, no CBC, no ssh-rsa)
 - **exec()-only** (no persistent su shells — fixes PTY leak)
 - **Sudo via stdin** (not argv — fixes process list leak)
@@ -673,6 +679,7 @@ Secrets are **never** passed as CLI arguments.
 | `--bearerToken` | — | Bearer token for HTTP transport auth (required for `--transport=http`) |
 | `--rateLimit` | 0 | HTTP requests per minute on the MCP route (0 = unlimited) |
 | `--allowedHosts` | bind address + localhost | Comma-separated Host headers accepted by the DNS-rebinding guard |
+| `--hostKeyMode` | `tofu` | `tofu \| strict \| insecure`. See [SECURITY.md](./SECURITY.md#host-key-trust-does-not-survive-a-restart) — `strict` currently refuses every host |
 | `--insecureHostKey` | false | Disable host key verification (test only!) |
 | `--allowUncheckedConfigAcl` | false | Windows: report every ACL finding and refuse none |
 | `--strictConfigAcl` | false | Windows: refuse on every ACL finding, including a read-only over-grant |
@@ -698,8 +705,8 @@ replacement, rather than failing later as a confusing auth error.
 | v1 | v2 | Notes |
 |----|----|-------|
 | `exec` | `read-command` | Allowlisted read-only commands. Prefer this for reads. |
-| `exec` | `run-command` | Arbitrary commands. Destructive ones go through the approval gate. |
-| `sudo-exec` | `privileged-command` | Always requires approval. Password is piped via stdin. |
+| `exec` | `run-command` | Arbitrary commands. Destructive and privileged ones go through the approval gate, unless `approvalPolicy = "auto"`. |
+| `sudo-exec` | `privileged-command` | Requires approval unless `approvalPolicy = "auto"`. Password is piped via stdin. |
 | `description` parameter | — | Removed. It was an injection vector (#44) and never reached the host. |
 
 **Command results now carry status.** In v1 a failed command rejected with
@@ -739,8 +746,12 @@ and pass `--config <path>`; profiles carry per-host roles and approval policy.
 ### Host key verification
 
 v1 did not verify host keys. v2 defaults to trust-on-first-use and records the
-key; a later mismatch fails the connection. Pin explicitly with `trustedHostKey`
-in a profile, or pass `--insecureHostKey` to opt out (test environments only).
+key **in memory, for the life of the process**; a later mismatch in that same
+process fails the connection. Nothing is written to disk and `~/.ssh/known_hosts`
+is not consulted, so a restart accepts afresh — see
+[SECURITY.md](./SECURITY.md#host-key-trust-does-not-survive-a-restart). Pin
+explicitly with `trustedHostKey` in a profile, which is the only control here that
+survives a restart, or pass `--insecureHostKey` to opt out (test environments only).
 
 ---
 

package/build/policy/classifier.js

@@ -135,9 +135,45 @@ const CLASS_RANK = {
     privileged: 3,
 };
 /** Shells that run their next argument as a command when given `-c`. */
-const SHELL_BINARIES = new Set([
-    'sh', 'bash', 'dash', 'zsh', 'ksh', 'ash', 'busybox',
-]);
+/**
+ * Interpreters, the flags that hand them a program, and whether this file can read it.
+ *
+ * One table rather than three overlapping name lists: adding an interpreter here is the
+ * whole change, and a shell list that drifts out of step with a readability list is how a
+ * new shell ends up treated as an unreadable interpreter.
+ *
+ * `readable` means the program is shell, so classifying it is this same job done again
+ * and the class it earns is real. Python, Perl, Ruby, Node and PHP are not: their program
+ * is a different language, and `os.system('sudo id')` carries an elevation the shell
+ * classifier cannot see. Pretending to parse them would be a worse answer than admitting
+ * we cannot, so an unreadable program makes the command `destructive` — "we cannot tell",
+ * not "this is root", the same answer `hasUnnameableCommand` gives.
+ *
+ * `busybox` is not here: it takes an applet name, not `-c`, so `busybox sh -c …` is an
+ * `sh` invocation behind a wrapper. It is in EXEC_WRAPPERS instead, which is what it is.
+ */
+// Null-prototype for the reason `mergePolicyRules` spells out (#172): this is indexed by
+// a command word, which is a free string, so on a plain object `INTERPRETERS['toString']`
+// resolves to a function and reading `.flags` off it throws inside the policy gate.
+const INTERPRETERS = Object.assign(Object.create(null), {
+    sh: { flags: ['-c'], readable: true },
+    bash: { flags: ['-c'], readable: true },
+    dash: { flags: ['-c'], readable: true },
+    zsh: { flags: ['-c'], readable: true },
+    ksh: { flags: ['-c'], readable: true },
+    ash: { flags: ['-c'], readable: true },
+    python: { flags: ['-c'], readable: false },
+    python2: { flags: ['-c'], readable: false },
+    python3: { flags: ['-c'], readable: false },
+    perl: { flags: ['-e', '-E'], readable: false },
+    ruby: { flags: ['-e'], readable: false },
+    // `-p`/`--print` evaluate exactly as `-e` does and then print the result.
+    node: { flags: ['-e', '--eval', '-p', '--print'], readable: false },
+    php: { flags: ['-r'], readable: false },
+});
+/** Flags whose value is a separate word, which is not the program. `awk -F ':' '{…}'`. */
+/** `find … -exec <cmd> +` runs cmd. */
+const FIND_EXEC_FLAGS = new Set(['-exec', '-execdir', '-ok', '-okdir']);
 /**
  * How deep a substitution may nest before we stop reading and refuse to guess.
  *
@@ -147,39 +183,156 @@ const SHELL_BINARIES = new Set([
  */
 const MAX_NESTING_DEPTH = 8;
 /**
- * Split on whitespace the way a shell would, keeping quoted runs together.
+ * Split a command into segments of words, resolving quoting as a shell would.
  *
- * `parseSegments` splits on `/\s+/`, which turns `sh -c "sudo id"` into
- * `["sh", "-c", "\"sudo", "id\""]` — the argument is no longer a unit, so nothing
- * downstream can classify it as the command it is.
+ * The classifier's regexes were written against the command as sent, but the transport
+ * removes quoting before the command runs, so `rm -rf "/etc"` matched no destructive
+ * pattern and `s"u"do id` named no privilege prefix. Every consumer that used to split on
+ * `/[;&|\n]/` and `/\s+/` reads this instead, so quote removal happens once, in one
+ * place, rather than being re-derived per rule.
+ *
+ * Not a shell parser. Variable expansion, arithmetic and here-documents are out of scope —
+ * `hasUnnameableCommand` is what refuses a command word this cannot resolve.
  */
-function splitRespectingQuotes(command) {
-    const words = [];
+function tokenizeSegments(command) {
+    return tokenizeSegmentsDetailed(command).map((segment) => segment.words);
+}
+/**
+ * The same split, keeping the separator that introduced each segment.
+ *
+ * Only the pipe rules need it: `|` feeds one command's output into the next, while `;`
+ * and `&` merely sequence, and a rule about pipes must not fire on a rule about sequences.
+ * Deriving both views from one tokeniser is what stops the two from drifting apart.
+ */
+function tokenizeSegmentsDetailed(command, honorQuotes = true) {
+    const segments = [];
+    let pending = '';
+    let words = [];
     let current = '';
     let quote = null;
+    let escaped = false;
+    const endWord = () => {
+        if (current)
+            words.push(current);
+        current = '';
+    };
+    const endSegment = (sep) => {
+        endWord();
+        if (words.length > 0)
+            segments.push({ words, sep: pending });
+        words = [];
+        pending = sep;
+    };
     for (const ch of command) {
+        if (escaped) {
+            // A backslash quotes the next character, so `\reboot` runs reboot. Keeping the
+            // character and dropping the backslash is what the shell does.
+            current += ch;
+            escaped = false;
+            continue;
+        }
         if (quote) {
+            // Backslash is literal inside single quotes; inside double quotes it escapes.
+            if (ch === '\\' && quote === '"') {
+                escaped = true;
+                continue;
+            }
             if (ch === quote)
                 quote = null;
             else
                 current += ch;
             continue;
         }
-        if (ch === '"' || ch === "'") {
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (honorQuotes && (ch === '"' || ch === "'")) {
             quote = ch;
             continue;
         }
+        if (ch === ';' || ch === '&' || ch === '|' || ch === '\n') {
+            endSegment(ch);
+            continue;
+        }
         if (/\s/.test(ch)) {
-            if (current)
-                words.push(current);
-            current = '';
+            endWord();
             continue;
         }
         current += ch;
     }
-    if (current)
-        words.push(current);
-    return words;
+    endSegment('');
+    // A quote left open at the end is not a command a shell would run — it is a syntax
+    // error. Reading it as one long quoted argument is the dangerous reading: `echo "hi;
+    // sudo id` then never splits on the `;` and the elevation disappears, which measured as
+    // `privileged` before this tokeniser and `safe` after. So fall back to the scan that
+    // treats the quote character as ordinary text, which splits and still sees `sudo id`.
+    if (quote !== null)
+        return tokenizeSegmentsDetailed(command, false);
+    return segments;
+}
+/**
+ * The command rebuilt from its tokens, for the regex rules to match against.
+ *
+ * Segments are rejoined with `; ` so a pattern cannot match across two commands that the
+ * shell would run separately.
+ */
+let lastNormalizedInput = null;
+let lastNormalizedOutput = '';
+function normalizeCommand(command) {
+    // One evaluate asks for this about nineteen times, once per regex rule, and each ask
+    // re-ran the tokeniser over the whole command. The asks arrive in a row on the same
+    // input, so a one-entry cache removes almost all of it.
+    if (command === lastNormalizedInput)
+        return lastNormalizedOutput;
+    lastNormalizedInput = command;
+    lastNormalizedOutput = normalizeUncached(command);
+    return lastNormalizedOutput;
+}
+function normalizeUncached(command) {
+    return tokenizeSegments(command)
+        .map((words) => words.map((w) => (QUOTED_CONTENT.test(w) ? PLACEHOLDER : w)).join(' '))
+        .join('; ');
+}
+/**
+ * A character the tokeniser splits on or at, which a token can only hold if it was quoted.
+ *
+ * The tokeniser splits on unquoted separators and at unquoted whitespace, so a token
+ * holding either came from inside quotes — the shell will not split there, and its contents are data. Rejoining it
+ * into the pattern text is what makes an argument read as a command: `echo "hello; rm -rf
+ * /"` prints a string, and normalising it produced `echo hello; rm -rf /`, which matched
+ * the never-allowed list. Dropping those tokens keeps quote removal doing the job it was
+ * added for — `rm -rf "/etc"`, whose tokens hold no separator — without letting a quoted
+ * argument impersonate a command. A carrier that really does hand over a quoted command
+ * (`sh -c "ls; rm -rf /etc"`) is read by `nestedCommands`, not by this.
+ */
+const QUOTED_CONTENT = /[\s;&|\n]/;
+/**
+ * What a quoted token becomes in the pattern text.
+ *
+ * Deleting it instead spliced its neighbours together and created an adjacency that appears
+ * nowhere in the command: `echo rm 'a|b' -rf /` normalised to `echo rm -rf /` and landed on
+ * the never-allowed list. A character no pattern contains and `\s` does not match stands in
+ * its place, so the two sides can no longer be read as one phrase.
+ */
+const PLACEHOLDER = '\u0000';
+/**
+ * Try a regex against the command as written and against the tokenised form.
+ *
+ * Normalising alone is not enough. It rebuilds the command from tokens, so the shell
+ * metacharacters between them are gone, and a pattern that matches across a separator no
+ * longer fires — the fork bomb, whose `:|:&` needs the literal `|` and `&`, is the case
+ * that shows this. Normalising is still what defeats `rm -rf "/etc"`. Neither form is a
+ * superset of the other, so both are tried: for a pattern whose whole job is to notice
+ * something, the union is the only direction that cannot lose a match.
+ *
+ * Deliberately scoped to regexes. The word-based rules in `FORBIDDEN_RULES` already
+ * tokenise, and handing them the normalised string turns a separator that was safely
+ * inside a quoted argument into a real one — `grep -E "warn|reboot" syslog` became an
+ * unconditional refusal, which is the mention-vs-invocation bug of #91 all over again.
+ */
+function matchesEitherForm(command, test) {
+    return test(command) || test(normalizeCommand(command));
 }
 /**
  * The commands hiding inside a command.
@@ -230,23 +383,57 @@ export function nestedCommands(command) {
         for (const raw of backticks)
             found.push(raw.slice(1, -1));
     }
-    // `sh -c <command>`. Carries no substitution at all, so the scan above does not
-    // see it; found while mapping the reported bypass rather than in the report.
-    const words = splitRespectingQuotes(command);
-    for (let i = 0; i < words.length; i++) {
-        if (!SHELL_BINARIES.has(stripPath(unquote(words[i]))))
-            continue;
-        for (let j = i + 1; j < words.length; j++) {
-            if (words[j] === '-c') {
-                if (words[j + 1] !== undefined)
-                    found.push(words[j + 1]);
-                break;
+    // A carrier hands a program to something that runs it. Carries no substitution, so the
+    // scan above does not see it. Read each segment's command word rather than scanning
+    // every word: matching a mention rather than an invocation is #91, and
+    // `cat /usr/bin/python3` names an interpreter without running one.
+    const segments = tokenizeSegmentsDetailed(command);
+    for (const { words } of segments) {
+        // Every word, not just the command word. Stopping at the head lost the carrier behind
+        // any wrapper this file does not list: `xargs -I {} sh -c 'sudo id'` stops on `{}`, and
+        // `flock`, `chroot`, `nsenter` and `systemd-run` are not wrappers it knows — all six
+        // went from `privileged` to `safe`. What keeps this from matching a *mention* is not
+        // where it looks but what it requires: `programAfterFlag` returns null unless a
+        // program-bearing flag actually follows, so `cat /usr/bin/python3` carries nothing.
+        //
+        // awk is deliberately absent. Its program is a positional operand rather than the
+        // value of a flag, so nothing distinguishes running awk from naming it, and its four
+        // implementations disagree about which flags consume a value — modelling that wrongly
+        // opened five separate holes across two review rounds. `awk` keeps the class it has on
+        // 2.5.1 and is tracked separately.
+        if (!operandsAreData(words)) {
+            for (let i = 0; i < words.length; i++) {
+                const spec = INTERPRETERS[stripPath(unquote(words[i]))];
+                if (spec === undefined || isFlagValue(words, i, spec.flags))
+                    continue;
+                const program = programAfterFlag(words, i, spec.flags);
+                if (program !== null)
+                    found.push(program);
             }
-            // Only flags may sit between the shell and its `-c`; anything else means
-            // this was not a `-c` invocation.
-            if (!words[j].startsWith('-'))
-                break;
         }
+        // `-exec` is a flag rather than a command word, so this one is still a scan.
+        for (let i = 0; i < words.length; i++) {
+            if (!FIND_EXEC_FLAGS.has(words[i]) || words[i + 1] === undefined)
+                continue;
+            const rest = words.slice(i + 1);
+            const stop = rest.findIndex((w) => w === '+' || w === ';');
+            found.push((stop === -1 ? rest : rest.slice(0, stop)).join(' '));
+            // Step past what was consumed. Leaving `i` where it was emitted one child per
+            // `-exec` token, each an overlapping suffix of the last and each still holding the
+            // rest of them, so the recursion re-expanded the same tail once per token: twenty
+            // `-ok` tokens in 81 bytes cost 17 seconds of a single-threaded event loop.
+            i = stop === -1 ? words.length : i + 1 + stop;
+        }
+    }
+    // A pipe stage whose command word is an interpreter with no program of its own runs
+    // whatever the previous stage printed. Starts at 1: a leading `|` records its separator
+    // on the first segment, and reading `segments[-1]` threw.
+    for (let i = 1; i < segments.length; i++) {
+        if (segments[i].sep !== '|')
+            continue;
+        if (!readsProgramFromStdin(segments[i].words))
+            continue;
+        found.push(segments[i - 1].words.join(' '));
     }
     return found.filter((c) => c.trim().length > 0);
 }
@@ -255,6 +442,8 @@ const PRIVILEGE_PREFIXES = new Set([
     // BusyBox/Alpine, Docker entrypoints, the Rust sudo now default on some
     // distributions, systemd's replacement, and the Solaris/illumos spelling.
     'su-exec', 'gosu', 'sudo-rs', 'run0', 'pfexec',
+    // Both reach root with the command otherwise classified `safe`.
+    'runuser', 'setpriv',
 ]);
 /**
  * Binaries whose job is to run another command.
@@ -273,6 +462,8 @@ const PRIVILEGE_PREFIXES = new Set([
 const EXEC_WRAPPERS = new Set([
     'env', 'nohup', 'nice', 'ionice', 'command', 'exec', 'setsid', 'stdbuf',
     'timeout', 'chrt', 'taskset', 'xargs', 'watch',
+    // `busybox <applet>` runs the applet, so it wraps rather than interprets.
+    'busybox',
 ]);
 /**
  * Arguments that turn an allowlisted binary into one that writes or executes.
@@ -283,9 +474,8 @@ const EXEC_WRAPPERS = new Set([
  * \;` form only escaped because `;` happens to be a shell metacharacter, while
  * the `+` terminator carries none.
  */
-const DISQUALIFYING_ARGS = {
-    find: /^-(exec|execdir|ok|okdir|delete|fprintf?|fls)$/,
-};
+// Null-prototype for the same reason as INTERPRETERS: indexed by the command word.
+const DISQUALIFYING_ARGS = Object.assign(Object.create(null), { find: /^-(exec|execdir|ok|okdir|delete|fprintf?|fls)$/ });
 /** A leading `NAME=value`, which a shell treats as an assignment, not a command. */
 const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
 /** `timeout 5s`, `nice 10` — a bare argument some wrappers take before the command. */
@@ -317,8 +507,16 @@ function stripPath(word) {
 }
 function parseSegments(command) {
     const segments = [];
-    for (const raw of command.split(/[;&|\n]/)) {
-        const words = raw.trim().split(/\s+/).filter(Boolean);
+    for (const words of tokenizeSegments(command)) {
+        const segment = parseWords(words);
+        if (segment !== null)
+            segments.push(segment);
+    }
+    return segments;
+}
+/** The same, for callers that already hold the tokenised words. */
+function parseWords(words) {
+    {
         let i = 0;
         while (i < words.length && PRIVILEGE_PREFIXES.has(stripPath(words[i]))) {
             i++;
@@ -330,10 +528,10 @@ function parseSegments(command) {
             }
         }
         if (i < words.length) {
-            segments.push({ head: stripPath(words[i]), args: words.slice(i + 1) });
+            return { head: stripPath(words[i]), args: words.slice(i + 1) };
         }
     }
-    return segments;
+    return null;
 }
 /**
  * Whether a segment asks for elevation, reading past anything that is not yet
@@ -395,8 +593,8 @@ function elevatedBinary(words) {
  * privileged decision — in the audit log, the OTel span and OPA's input (#134).
  */
 function elevatedBinaryOf(command) {
-    for (const segment of command.split(/[;&|\n]/)) {
-        const found = elevatedBinary(segment.trim().split(/\s+/).filter(Boolean));
+    for (const words of tokenizeSegments(command)) {
+        const found = elevatedBinary(words);
         if (found !== null)
             return found;
     }
@@ -441,7 +639,13 @@ const DOWNLOADERS = new Set(['curl', 'wget']);
  * running one when it succeeds.
  */
 function pipesDownloadIntoShell(command) {
-    const heads = command.split('|').map((part) => parseSegments(part)[0]?.head);
+    // One head per pipe stage. Splitting on every separator would make `curl -O x;
+    // bash build.sh` — download, then run a local script — match a rule whose label says
+    // "piping a download into a shell", on a list that cannot be switched off.
+    const segments = tokenizeSegmentsDetailed(command);
+    const heads = segments
+        .filter((segment, i) => i === 0 || segment.sep === '|')
+        .map((segment) => parseWords(segment.words)?.head);
     const firstDownload = heads.findIndex((h) => h !== undefined && DOWNLOADERS.has(h));
     if (firstDownload === -1)
         return false;
@@ -466,7 +670,10 @@ function chownsRoot(command) {
     });
 }
 const FORBIDDEN_RULES = [
-    ...FORBIDDEN_PATTERNS.map((re) => ({ label: String(re), test: (c) => re.test(c) })),
+    ...FORBIDDEN_PATTERNS.map((re) => ({
+        label: String(re),
+        test: (c) => matchesEitherForm(c, (form) => re.test(form)),
+    })),
     {
         label: 'invoking a power-state command (shutdown, reboot, halt, poweroff) or eval',
         test: (command) => invokedWords(command).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
@@ -524,7 +731,8 @@ const DESTRUCTIVE_PATTERNS = [
  * either.
  */
 function isDestructive(command) {
-    return isForbidden(command) || DESTRUCTIVE_PATTERNS.some((re) => re.test(command));
+    return (isForbidden(command) ||
+        matchesEitherForm(command, (form) => DESTRUCTIVE_PATTERNS.some((re) => re.test(form))));
 }
 const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*sudo\b/,
@@ -533,7 +741,12 @@ const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*pkexec\b/,
 ];
 export function extractBinary(command) {
-    let cmd = command.trim();
+    // The first segment's words, so quoting is resolved — `s"u"do id` used to report
+    // `s"u"do` in the audit record and the refusal message. Reading the normalised whole
+    // command instead would be wrong in the other direction: it rejoins segments with
+    // `; `, so `ls | grep x` would report `ls;`, and this name reaches the audit record,
+    // the OTel span and OPA's input (#134). A separator is not a binary.
+    let cmd = (tokenizeSegments(command)[0] ?? []).join(' ').trim();
     for (const prefix of LEADING_PRIVILEGE_PREFIXES) {
         cmd = cmd.replace(prefix, '').trim();
     }
@@ -551,6 +764,16 @@ export function extractBinary(command) {
  * whether that name is knowable at all.
  */
 function effectiveCommandWord(words) {
+    const i = effectiveCommandIndex(words);
+    return i === -1 ? null : words[i];
+}
+/**
+ * The position of that word, for callers that need to read its arguments.
+ *
+ * Deriving the word from the index rather than searching for it afterwards is what keeps
+ * `sh x sh -c 'sudo id'` from finding the wrong `sh`.
+ */
+function effectiveCommandIndex(words) {
     let i = 0;
     while (i < words.length) {
         const raw = words[i];
@@ -569,10 +792,167 @@ function effectiveCommandWord(words) {
             i++;
             continue;
         }
-        return raw;
+        return i;
+    }
+    return -1;
+}
+/**
+ * Whether this segment's command word is one whose operands are data.
+ *
+ * The carrier scan reads every word, because a wrapper this file does not list would
+ * otherwise hide `sh -c`. The cost is that an outer tool's own flag can be mistaken for an
+ * interpreter's: `grep python3 -c /var/log/x` counts lines, and `-c` is also python's
+ * program flag. An allowlisted command is one this file already vouches for as reading
+ * rather than running, so its arguments are subjects, not commands — the positive form of
+ * the mention-vs-invocation rule at #91. `find` keeps its `-exec` scan, which is separate.
+ */
+function operandsAreData(words) {
+    const idx = effectiveCommandIndex(words);
+    return idx !== -1 && READ_ONLY_ALLOWLIST.has(stripPath(unquote(words[idx])));
+}
+/**
+ * Whether an interpreter name is the value of the flag before it rather than a command.
+ *
+ * The scan looks at every word so that a carrier behind an unlisted wrapper is not lost,
+ * and requires a program-bearing flag to follow before it believes one. That is not quite
+ * enough: `grep -e perl -e python` puts `perl` after a flag and a second `-e` after it,
+ * which reads as perl being handed a program. A search term is not a command.
+ *
+ * The test is deliberately narrow — the preceding flag must be one of *this interpreter's*
+ * program flags. Any flag at all was too much: `nsenter -t 1 -m sh -c 'sudo id'` puts the
+ * shell after `-m`, which takes no value, and dropping it lost a real elevation. Nothing
+ * here can know an arbitrary tool's grammar, so `sed -n perl -e p` — a shape no one
+ * writes — is still read as a carrier.
+ */
+function isFlagValue(words, i, flags) {
+    if (i === 0)
+        return false;
+    const previous = words[i - 1];
+    return previous.length > 1 && previous.startsWith('-') && flags.includes(previous);
+}
+/**
+ * The program an interpreter was handed on its command line, or null.
+ *
+ * Only flags may sit between the interpreter and its flag; anything else means this was
+ * not that kind of invocation, which is what keeps `python3 script.py` — a program this
+ * cannot read either, but one every deployment runs — out of the gate.
+ */
+function programAfterFlag(words, from, flags) {
+    for (let j = from + 1; j < words.length; j++) {
+        const word = words[j];
+        if (flags.includes(word))
+            return words[j + 1] ?? null;
+        const attached = flags.find((f) => word.startsWith(f) && word.length > f.length);
+        if (attached !== undefined) {
+            const rest = word.slice(attached.length);
+            // `sh -c'sudo id'` tokenises to `-csudo id`, so the program is attached. `bash -cx`
+            // is a flag cluster and the program is the next word. A space, or the `=` of
+            // `--eval=…`, is what tells them apart: a cluster is letters only.
+            if (/\s/.test(rest) || rest.startsWith('='))
+                return rest.replace(/^=/, '');
+            return words[j + 1] ?? null;
+        }
+        // The program flag need not lead the cluster: `bash -xc 'sudo id'` runs exactly what
+        // `bash -cx 'sudo id'` runs, and a prefix test saw the second and missed the first.
+        if (clusterCarriesFlag(word, flags))
+            return words[j + 1] ?? null;
+        if (!word.startsWith('-'))
+            return null;
     }
     return null;
 }
+/**
+ * What follows a short flag inside a single-dash cluster, or null if it holds none.
+ *
+ * Clusters only — a run of single letters after one dash. Long flags and attached values
+ * are handled before this is reached.
+ */
+function clusterCarriesFlag(word, flags) {
+    // Three letters at most. `/^-[A-Za-z]+$/` alone also matches every single-dash long
+    // option, and `find`'s predicates are full of them: `-type` contains perl's `-e`, so
+    // `find . -name perl -type f` read as a carrier and asked for approval.
+    if (!/^-[A-Za-z]{2,3}$/.test(word))
+        return false;
+    const body = word.slice(1);
+    // A cluster is letters only, so whatever follows the program flag is more flags — the
+    // program itself is always the next word.
+    return flags.some((flag) => flag.length === 2 && body.includes(flag[1]));
+}
+/** Spellings of "the program is on standard input" that look like a file operand. */
+const STDIN_PATHS = new Set(['-', '/dev/stdin', '/dev/fd/0', '/proc/self/fd/0']);
+/**
+ * Whether a segment's command word is an interpreter with no program of its own.
+ *
+ * `echo "sudo id" | bash` hands the program over on stdin, where there is nothing to
+ * read. This holds for the shells too — `readable` is about a `-c` argument, and there is
+ * no `-c` here. Requiring that no operand follow is what keeps `cat data | python3
+ * app.py` out of it: there the pipe carries data, not a program.
+ */
+function readsProgramFromStdin(words) {
+    const idx = effectiveCommandIndex(words);
+    if (idx === -1)
+        return false;
+    const bin = stripPath(words[idx]);
+    // Interpreters only. awk's one program-from-stdin form is `awk -f -`, already gated as a
+    // file flag; every other piped awk reads data, not a program.
+    const spec = INTERPRETERS[bin];
+    if (spec === undefined)
+        return false;
+    const flags = spec.flags;
+    let sawStdinFlag = false;
+    for (let j = idx + 1; j < words.length; j++) {
+        const word = words[j];
+        if (flags.some((f) => word === f || word.startsWith(f)))
+            return false;
+        // `--` ends the interpreter's own arguments; what follows is `$1..$n`, so a program
+        // still has to come from somewhere and `bash -s -- arg` reads stdin.
+        // `-s` says outright that the script comes from stdin, so everything after it is
+        // `$1..$n` whatever it looks like.
+        if (word === '-s') {
+            sawStdinFlag = true;
+            continue;
+        }
+        // `--` ends the interpreter's own arguments. Without `-s` the next word is the script
+        // itself, so `bash -- process.sh` reads a file while `bash -s -- arg` reads stdin.
+        if (word === '--') {
+            const next = words[j + 1];
+            return sawStdinFlag || next === undefined || STDIN_PATHS.has(next);
+        }
+        if (STDIN_PATHS.has(word))
+            return true;
+        if (!word.startsWith('-'))
+            return false;
+    }
+    return true;
+}
+/**
+ * Whether any segment hands a program to something this file cannot read.
+ *
+ * Keyed on the segment's command word, never on any word that happens to name an
+ * interpreter: matching a mention rather than an invocation is the defect this file
+ * records fixing as #91, and `cat /usr/bin/python3` names an interpreter without running
+ * one. A program-bearing flag must actually be present, so naming one is not enough.
+ */
+function hasUnreadableProgram(command) {
+    const segments = tokenizeSegmentsDetailed(command);
+    for (let i = 0; i < segments.length; i++) {
+        const { words, sep } = segments[i];
+        if (sep === '|' && readsProgramFromStdin(words))
+            return true;
+        if (!operandsAreData(words)) {
+            for (let j = 0; j < words.length; j++) {
+                const spec = INTERPRETERS[stripPath(unquote(words[j]))];
+                if (spec === undefined || spec.readable)
+                    continue;
+                if (isFlagValue(words, j, spec.flags))
+                    continue;
+                if (programAfterFlag(words, j, spec.flags) !== null)
+                    return true;
+            }
+        }
+    }
+    return false;
+}
 /**
  * Whether any segment runs a command this process cannot name.
  *
@@ -591,49 +971,79 @@ function effectiveCommandWord(words) {
  * promoting that would put a prompt on most ordinary shell usage.
  */
 function hasUnnameableCommand(command) {
-    for (const raw of command.split(/[;&|\n]/)) {
-        const words = raw.trim().split(/\s+/).filter(Boolean);
+    for (const words of tokenizeSegments(command)) {
         const head = effectiveCommandWord(words);
         if (head !== null && /[$`]/.test(head))
             return true;
     }
     return false;
 }
+/**
+ * Commands this server synthesises rather than a user typing them.
+ *
+ * These reach the classifier as text like `sftp:upload /etc/passwd`, and no rule named
+ * them, so every one fell through to the default `safe` — a class the default rules grant
+ * to `operator` on `prod`. Writing an arbitrary file to the target is not `safe`: it is
+ * the same authority as `rm`, spelled through a different tool, and it reaches
+ * `~/.ssh/authorized_keys` without touching a shell. Opening a session is the same
+ * argument, since it hands over an interactive shell.
+ *
+ * `sftp:download` and `session:close` are deliberately absent. Both would move *down*
+ * from `safe` — download to `read-only`, matching its `readOnlyHint`, and close being a
+ * release rather than an acquisition. Lowering a class is a widening, and a security
+ * release is the wrong place for one; they keep the class they have today.
+ */
+const SYNTHETIC_CLASSES = Object.assign(Object.create(null), {
+    'sftp:upload': 'destructive',
+    'session:open': 'destructive',
+});
+/** The first word, tokenised — the synthetic verb when there is one. */
+function syntheticVerb(command) {
+    return tokenizeSegments(command)[0]?.[0] ?? '';
+}
+/**
+ * The class of a command, and of everything it carries.
+ *
+ * A command that carries another decides nothing on its own: the remote shell expands
+ * `$(...)`, backticks, `<(...)` and `sh -c` and runs what is inside, so the class is the
+ * higher of the two. The scan for carriers already existed, but it *replaced* the outer
+ * class instead of raising it, and only when the inner class was above `safe` — so
+ * `sudo sh -c 'rm -rf /etc'` reported the inner `destructive` and lost the outer
+ * `privileged`, which on `prod` is the difference between a prompt and a refusal.
+ * Taking the maximum is what makes the scan unable to lower anything.
+ */
 export function classifyCommand(command, depth = 0) {
     const trimmed = command.trim();
-    const binary = extractBinary(trimmed);
-    const fullCommand = trimmed;
-    // A command that carries another command decides nothing on its own: the remote
-    // shell expands `$(...)`, backticks, `<(...)` and `sh -c` and runs what is inside,
-    // so the class has to be the higher of the two. Before this, the outer command
-    // decided alone and `echo $(sudo id)` was `safe` — a class the default rules grant
-    // on `prod` to `operator` and `admin`, while granting `privileged` there to nobody
-    // at all (GHSA-v8jh-gv7v-3gvq). It also skipped the approval prompt, since only
-    // `destructive` and `privileged` raise one, and the audit record said `safe`.
-    //
-    // Runs before the checks below rather than after, so the class it produces is not
-    // something a later branch can lower.
-    if (depth < MAX_NESTING_DEPTH) {
-        let highest = null;
-        for (const inner of nestedCommands(trimmed)) {
-            const parsed = classifyCommand(inner, depth + 1);
-            if (highest === null || CLASS_RANK[parsed.class] > CLASS_RANK[highest.class]) {
-                highest = parsed;
-            }
-        }
-        // `binary` comes from the inner command deliberately: it is what the audit
-        // record and the refusal message name, and naming the outer `echo` would
-        // describe the wrong process as the one that ran as root.
-        if (highest !== null && CLASS_RANK[highest.class] > CLASS_RANK['safe']) {
-            return { binary: highest.binary, fullCommand, class: highest.class };
-        }
-    }
-    else {
+    const outer = classifyOuter(trimmed);
+    if (depth >= MAX_NESTING_DEPTH) {
         // Nesting this deep is not something an operator writes, and we have stopped
-        // reading. Refusing to guess is the only answer consistent with the rest of
-        // this function.
-        return { binary, fullCommand, class: 'privileged' };
+        // reading. Refusing to guess is the only answer consistent with the rest of this
+        // file.
+        return { binary: outer.binary, fullCommand: trimmed, class: 'privileged' };
+    }
+    let highest = outer;
+    // A floor, not a verdict. Returning the synthetic class outright would put it above
+    // the elevation and never-allowed checks, so `sftp:upload /tmp/x; sudo id` would
+    // record `destructive` where the command is `privileged`.
+    const verb = syntheticVerb(trimmed);
+    const floor = SYNTHETIC_CLASSES[verb];
+    if (floor !== undefined && CLASS_RANK[floor] > CLASS_RANK[highest.class]) {
+        highest = { binary: verb, fullCommand: trimmed, class: floor };
+    }
+    for (const inner of nestedCommands(trimmed)) {
+        const parsed = classifyCommand(inner, depth + 1);
+        // `binary` follows the winning side deliberately: it is what the audit record and
+        // the refusal message name, and naming the outer `echo` would describe the wrong
+        // process as the one that ran as root.
+        if (CLASS_RANK[parsed.class] > CLASS_RANK[highest.class])
+            highest = parsed;
     }
+    return { binary: highest.binary, fullCommand: trimmed, class: highest.class };
+}
+/** The class of the command itself, reading none of what it carries. */
+function classifyOuter(trimmed) {
+    const binary = extractBinary(trimmed);
+    const fullCommand = trimmed;
     // `binary` names the subject of the class. For everything below it is the
     // leading command; here it is the one that runs as root, which are the same
     // thing only when the prefix leads.
@@ -641,7 +1051,7 @@ export function classifyCommand(command, depth = 0) {
     if (elevated !== null) {
         return { binary: elevated, fullCommand, class: 'privileged' };
     }
-    if (isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
+    if (hasUnreadableProgram(trimmed) || isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };
     }
     // Below this point every branch assumes the command word names something we
@@ -655,7 +1065,7 @@ export function classifyCommand(command, depth = 0) {
     if (hasUnnameableCommand(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };
     }
-    const twoWordPrefix = fullCommand.split(/\s+/).slice(0, 2).join(' ');
+    const twoWordPrefix = (tokenizeSegments(fullCommand)[0] ?? []).slice(0, 2).join(' ');
     if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)) {
         if (SHELL_CONTROL_CHARS.test(trimmed)) {
             return { binary, fullCommand, class: 'safe' };

package/build/policy/engine.js

@@ -3,7 +3,11 @@ import { OperatorError } from '../errors.js';
 /** Tiers, most restrictive first. Unknown/unset tiers resolve to the first. */
 export const HOST_GROUPS = ['prod', 'staging', 'dev'];
 export const DEFAULT_RULES = {
-    roleBindings: {
+    // Null-prototype for the reason spelled out at `mergePolicyRules`: a role name is
+    // a free string, and this object is indexed by it. `mergePolicyRules` returns this
+    // one unchanged when there is no override, so fixing only the merged copy would
+    // leave the commonest path — no `[policy]` section at all — on a plain object.
+    roleBindings: Object.assign(Object.create(null), {
         viewer: {
             prod: ['read-only'],
             staging: ['read-only'],
@@ -19,7 +23,7 @@ export const DEFAULT_RULES = {
             staging: ['read-only', 'safe', 'destructive', 'privileged'],
             dev: ['read-only', 'safe', 'destructive', 'privileged'],
         },
-    },
+    }),
 };
 /**
  * Layer an operator's `[policy]` section over the compiled-in defaults.
@@ -46,7 +50,25 @@ export function mergePolicyRules(base, override) {
         return base;
     // Copy every tier map: assigning base's objects straight through would let a
     // later merge mutate DEFAULT_RULES, which is a module-level singleton.
-    const roleBindings = {};
+    //
+    // `Object.create(null)`, not `{}`, because the loop below assigns a key the
+    // operator chose: `roleBindings[role] = ...` with `role === '__proto__'` invokes
+    // the prototype setter on a plain object rather than creating a key. Measured, the
+    // effect is not global — `Object.prototype` is untouched — but this object's own
+    // prototype is replaced by the operator's tier map, after which `roleBindings.prod`
+    // resolves through the chain as though `prod` were a role. Reported as
+    // https://github.com/tufantunc/ssh-mcp/issues/172.
+    //
+    // Reaching it needs the schema guard in config/schema.ts to be bypassed first, and
+    // that guard is exactly what zod 4 silently disabled once already (2.5.0 rebuilt
+    // it). Insurance in the authorization engine is worth one function call.
+    //
+    // It also removes a second case with no config involved: on a plain object,
+    // `roleBindings['toString']` returns a function, so a profile whose role is named
+    // after an `Object.prototype` member found a truthy "binding". That failed closed —
+    // `findPolicyProblems` still refused it and evaluation floored at read-only — but it
+    // took a different branch than an unknown role, for no reason a reader could see.
+    const roleBindings = Object.create(null);
     for (const [role, groups] of Object.entries(base.roleBindings)) {
         roleBindings[role] = { ...groups };
     }

package/build/tools/descriptions.js

@@ -6,8 +6,8 @@ export const TOOL_DESCRIPTIONS = {
     'close-session': 'Close a named session. A background session\'s command is signalled on the host (INT, then TERM, then KILL) before its channel is dropped; an interactive session\'s shell is ended. The response says so if the command could not be signalled or had not stopped in time.',
     'read-session-output': 'Read recent output from a background session (e.g., tail -f logs).',
     'read-command': 'Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations.',
-    'run-command': 'Execute an arbitrary shell command on the remote server. May modify the system. Destructive commands require user approval.',
-    'privileged-command': 'Execute a command with sudo elevation. ALWAYS requires user approval. The sudo password is piped via stdin (never visible in process list).',
+    'run-command': 'Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal.',
+    'privileged-command': 'Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin (never visible in process list).',
     'sftp-upload': 'Upload a file to the remote server via SFTP (secure file transfer, not shell-based).',
     'sftp-download': 'Download a file from the remote server via SFTP.',
     'signal-process': 'Send a signal (INT, TERM, KILL) to a remote process by PID.',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",
@@ -29,9 +29,9 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
     "@opentelemetry/resources": "^2.9.0",
-    "@opentelemetry/sdk-node": "^0.220.0",
+    "@opentelemetry/sdk-node": "^0.221.0",
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "smol-toml": "^1.7.0",
     "ssh2": "^1.17.0",