ssh-mcp 2.8.2 → 2.8.3

package/build/guard/sanitizer.js

@@ -1,13 +1,41 @@
 import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
-const CONTROL_CHARS = /[\r\n\u2028\u2029\x00]/g;
+/** Every character a shell would read as the end of one command and the start of another. */
+const LINE_BREAKS = /[\r\n\u2028\u2029]/;
+const NUL = /\u0000/;
+/**
+ * Validate a caller-supplied command.
+ *
+ * A line break is refused, not removed. The constraint itself is not negotiable
+ * — a newline inside `command` would let a second command ride along past a
+ * classifier that parsed only the first, which is #44 — but an earlier version
+ * enforced it by replacing the break with a space, and *that* is the part worth
+ * changing. The caller got no error and a different command than it asked for:
+ * two lines joined, so `ls\necho x` ran `ls echo x`; or a `#` comment in a
+ * `python3 -c` body pulled onto the same line, commenting out everything after
+ * it. Sometimes that raises. Sometimes it runs and quietly does half the work,
+ * which is the failure mode worth removing (#198).
+ *
+ * Trailing and leading breaks are trimmed rather than refused. A client that
+ * appends a newline works today, refusing it would break that for no gain, and
+ * a break at either end cannot join two commands.
+ */
 export function sanitizeCommand(command, maxChars) {
     if (typeof command !== 'string') {
         throw new McpError(ErrorCode.InvalidParams, 'Command must be a string');
     }
-    const cleaned = command.replace(CONTROL_CHARS, ' ').trim();
+    const cleaned = command.trim();
     if (!cleaned) {
         throw new McpError(ErrorCode.InvalidParams, 'Command cannot be empty');
     }
+    if (LINE_BREAKS.test(cleaned)) {
+        throw new McpError(ErrorCode.InvalidParams, 'Command cannot contain a line break: a second line would run past the classifier ' +
+            'that only saw the first. It is refused rather than silently joined into one line, ' +
+            'which is what happened before and changed what ran without saying so. ' +
+            'To run a multi-line script, upload it with sftp-upload and execute it by path.');
+    }
+    if (NUL.test(cleaned)) {
+        throw new McpError(ErrorCode.InvalidParams, 'Command cannot contain a null byte');
+    }
     if (Number.isFinite(maxChars) && cleaned.length > maxChars) {
         throw new McpError(ErrorCode.InvalidParams, `Command is too long (max ${maxChars} characters)`);
     }

package/build/ssh/connection.js

@@ -47,6 +47,8 @@ export class SSHConnection {
     sessions;
     activeChannels = 0;
     connecting = null;
+    /** Which connect() call currently owns `connecting`; see connect(). */
+    connectAttempt = null;
     connected = false;
     connectedAt = null;
     lastActivity = new Date();
@@ -94,6 +96,22 @@ export class SSHConnection {
         return this.connecting;
     }
     async connect() {
+        // Identity for this attempt, so "does this attempt still own `connecting`?"
+        // can be asked without going through `this.client`.
+        //
+        // Those are two different questions and conflating them is #197: settle()
+        // used to clear `connecting` only `if (isCurrent())`, and the disconnect
+        // handler nulls `this.client` *before* it settles. `isCurrent()` was
+        // therefore already false, `connecting` kept the rejected promise, and
+        // `ensureConnected()` replayed it for the life of the process — every later
+        // call on the profile failing instantly with a stale message, and no way
+        // back even once the server recovered. Restarting the server was the only
+        // exit, which is exactly how it was reported.
+        //
+        // Reordering the two statements would also have worked and would have left
+        // the same trap for the next edit; the coupling is what had to go.
+        const attempt = Symbol('connect');
+        this.connectAttempt = attempt;
         return new Promise((resolve, reject) => {
             // Every handler below acts on `client`, not `this.client`, and only
             // mutates shared state while it is still the current client. A late event
@@ -108,7 +126,9 @@ export class SSHConnection {
                     return;
                 settled = true;
                 clearTimeout(timeoutId);
-                if (isCurrent())
+                // Unconditional for *this* attempt: a superseded one leaves the newer
+                // attempt's promise alone, and nothing else can strand it.
+                if (this.connectAttempt === attempt)
                     this.connecting = null;
                 fn();
             };

package/build/tools/descriptions.js

@@ -5,9 +5,9 @@ export const TOOL_DESCRIPTIONS = {
     'open-session': 'Open a named session on a remote host. Use type="interactive" for stateful shell (CWD/env persists between commands) or type="background" for long-running processes.',
     'close-session': 'Close a named session. A background session\'s command is signalled on the host (INT, then TERM, then KILL) before its channel is dropped; an interactive session\'s shell is ended. The response says so if the command could not be signalled or had not stopped in time.',
     'read-session-output': 'Read recent output from a background session (e.g., tail -f logs).',
-    'read-command': 'Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations.',
-    'run-command': 'Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal.',
-    'privileged-command': 'Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin (never visible in process list).',
+    'read-command': 'Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations. Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
+    'run-command': 'Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
+    'privileged-command': 'Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin (never visible in process list). Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
     'sftp-upload': 'Upload a file to the remote server via SFTP (secure file transfer, not shell-based).',
     'sftp-download': 'Download a file from the remote server via SFTP.',
     'signal-process': 'Send a signal (INT, TERM, KILL) to a remote process by PID.',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.8.2",
+  "version": "2.8.3",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",