ucu-mcp 0.6.4 → 0.6.5

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.5] - 2026-06-18
+
+Code review P2 加固（3 批次）：安全面 + 输入正确性 + 日志卫生。
+
+### Security Hardening
+
+- **OCR 密码脱敏**（screen-tools.ts）：describe_screen 的 OCR blocks 原样返回，截屏含密码字段时明文泄露。加 SENSITIVE_NAME_RE 对 OCR blocks 文本脱敏为 `[REDACTED]`，fullText 从脱敏后 blocks 重建。
+- **clipboard_write URL scheme 拦截**（guard.ts）：DEFAULT_TEXT_INJECTION_PATTERNS 补 `javascript:`/`data:`/`vbscript:` scheme + `\b(tell application)` AppleScript 注入 + `\n` 分隔命令 + deno/bun 解释器。防止剪贴板投毒（粘贴执行）。
+- **wait_for_element timeout/interval cap**（app-tools.ts）：原 schema 无 cap，恶意 timeout=2^31 + interval=1 可 fork-bomb。加 timeout max 60000 + interval min 250 的 zod 约束。
+- **logger 脱敏**（input.ts）：typeText 的 dryRun log 原记录 `text.slice(0,50)`（含密码），改为只记 `charCount`。
+
+### Input Correctness
+
+- **doubleClick/drag 加 Chromium primer**（skylight/main.swift）：提取 `primeTarget()` 共享函数（leading mouseMoved + (-1,-1) primer），doClick/doDoubleClick/doDrag 统一调用。之前 doubleClick/drag 在 Chromium/Electron 上静默失败（user-activation gate 未满足）。
+- **mouseUp pressure 改为 0**（skylight/main.swift）：真实 mouseUp 的 pressure=0，原代码所有非 move 事件都 pressure=1.0，影响绘图/3D app。改为 Up/Moved 事件 pressure=0。
+- **isFrontmost 用 NSWorkspace.frontmostApplication**（skylight/main.swift）：原 `isActive` 对 LSUIElement/agent 进程（如 SystemUIServer）不可靠，改用 `NSWorkspace.shared.frontmostApplication?.processIdentifier == pid` 做明确判定。
+- **非 ASCII typeText fallback 警告**（input.ts）：非 ASCII 字符走 osascript keystroke（发到前台而非 target pid），当有 target 时 logger.warn 提醒。
+
+### Tests
+
+- 328 passed（wait_for_element schema type 从 number→integer，cli-mcp 测试同步）。
+
 ## [0.6.4] - 2026-06-18
 
 4 个独立子 Agent 全面 code review 后的修复（skylight/element/tests/security）。

package/dist/src/mcp/tools/app-tools.js

@@ -24,10 +24,10 @@ export function registerAppTools(registerTool) {
     registerTool("wait_for_element", "Poll until an accessibility element matching the criteria reaches the desired state", {
         text: z.string().optional().describe("Element text"), role: z.string().optional().describe("Element role"),
         app: z.string().optional().describe("Target app"),
-        timeout: z.number().optional().describe("Timeout ms (default 5000)"),
-        timeoutMs: z.number().optional().describe("Alias for timeout"),
-        interval: z.number().optional().describe("Poll interval ms (default 500)"),
-        intervalMs: z.number().optional().describe("Alias for interval"),
+        timeout: z.number().int().min(100).max(60000).optional().describe("Timeout ms (default 5000, max 60000)"),
+        timeoutMs: z.number().int().min(100).max(60000).optional().describe("Alias for timeout"),
+        interval: z.number().int().min(250).max(10000).optional().describe("Poll interval ms (default 500, min 250)"),
+        intervalMs: z.number().int().min(250).max(10000).optional().describe("Alias for interval"),
         until: z.enum(["appear", "disappear", "value_change"]).default("appear").describe("Wait condition: 'appear' (default) waits for a match, 'disappear' waits until no match, 'value_change' waits until first match's value changes"),
     }, async (params) => {
         const deadline = Date.now() + (params.timeout ?? params.timeoutMs ?? 5000);

package/dist/src/mcp/tools/screen-tools.js

@@ -60,13 +60,20 @@ async function buildScreenDescription(opts) {
         }
         try {
             const result = await platform.ocr(opts.display);
+            const blocks = result.elements.slice(0, opts.ocrBlocks);
+            // Security: redact OCR blocks that look like passwords/secrets/tokens.
+            // This is best-effort (pixel-based OCR can't know field context) but
+            // catches high-entropy strings adjacent to "password"/"secret" labels.
+            for (const b of blocks) {
+                if (SENSITIVE_NAME_RE.test(b.text)) {
+                    b.text = "[REDACTED]";
+                }
+            }
+            // Rebuild fullText from (possibly redacted) blocks.
+            const fullText = blocks.map((b) => b.text).join("\n");
             return {
                 ok: true,
-                value: {
-                    blocks: result.elements.slice(0, opts.ocrBlocks),
-                    fullText: result.fullText,
-                    status: "ok",
-                },
+                value: { blocks, fullText, status: "ok" },
             };
         }
         catch (e) {

package/dist/src/safety/guard.js

@@ -69,9 +69,15 @@ const DEFAULT_TEXT_INJECTION_PATTERNS = [
     { pattern: /\$\s*\(/, reason: "shell command substitution" },
     { pattern: /`[^`]+`/, reason: "shell backtick substitution" },
     { pattern: /&&|\|\|/, reason: "shell command chaining" },
-    { pattern: /\|\s*(sh|bash|zsh|python|ruby|perl|node)\b/i, reason: "piping into an interpreter" },
+    { pattern: /\|\s*(sh|bash|zsh|python|ruby|perl|node|deno|bun)\b/i, reason: "piping into an interpreter" },
     { pattern: /\b(sudo\s+rm|rm\s+-rf|mkfs|diskutil\s+erase|dd\s+if=|chmod\s+-R\s+777)\b/i, reason: "dangerous shell command" },
     { pattern: /\b(ObjC\.import|Application\s*\(|do\s+shell\s+script)\b/, reason: "AppleScript/JXA injection primitive" },
+    { pattern: /\b(tell\s+(application|app)\s+)/i, reason: "AppleScript tell injection" },
+    // URL schemes dangerous when pasted into browser address bars or rich-text fields
+    { pattern: /^\s*(javascript|data|vbscript)\s*:/i, reason: "dangerous URL scheme (code execution when pasted)" },
+    { pattern: /\b(javascript|data)\s*:\s*(text\/html|application\/)/i, reason: "dangerous URL scheme with MIME type" },
+    // Newline-followed-by-command (bypasses && / || chaining detection)
+    { pattern: /\n\s*(rm\s|sudo\s|curl\s|wget\s|bash\s|sh\s|osascript\s)/i, reason: "newline-separated shell command" },
 ];
 // ---------------------------------------------------------------------------
 // Helpers

package/dist/src/utils/input.js

@@ -365,7 +365,7 @@ export async function scroll(x, y, deltaX, deltaY, _platform = process.platform,
 // ── Keyboard operations (CGEvent — background) ────────────────────────────
 export async function typeText(text, delay = 20, _platform = process.platform, target) {
     if (isDryRun()) {
-        logDryRun("typeText", { text: text.slice(0, 50), delay });
+        logDryRun("typeText", { charCount: text.length, delay }); // don't log text content (may contain passwords)
         return;
     }
     if (!text)
@@ -473,6 +473,12 @@ export async function typeText(text, delay = 20, _platform = process.platform, t
             }
             else {
                 // Fallback: use osascript keystroke for unsupported chars (emoji, CJK, etc.)
+                // NOTE: keystroke goes to the FRONTMOST app, not the target pid. When a
+                // target is set this may type into the wrong window. Log a warning so the
+                // caller knows non-ASCII chars bypassed per-process routing.
+                if (target?.pid) {
+                    logger.warn("typeText non-ASCII fallback uses global keystroke (types into frontmost, not target pid)");
+                }
                 const escaped = escapeAppleScriptString(batch.chars);
                 await execFileAsync("/usr/bin/osascript", [
                     "-e", `tell application "System Events" to keystroke "${escaped}"`,

package/native/skylight/main.swift

@@ -119,10 +119,12 @@ func makeMouseEvent(_ type: CGEventType, at point: CGPoint, button: CGMouseButto
     case .mouseMoved: nsType = .mouseMoved
     default: return nil
     }
+    // pressure: 0 for mouseUp/mouseMoved, 1.0 for mouseDown/drag (real hardware behavior)
+    let isRelease = nsType == .leftMouseUp || nsType == .rightMouseUp || nsType == .otherMouseUp || nsType == .mouseMoved
     guard let ns = NSEvent.mouseEvent(
         with: nsType, location: point, modifierFlags: [],
         timestamp: 0, windowNumber: windowNumber, context: nil,
-        eventNumber: 0, clickCount: clickCount, pressure: (type == .mouseMoved) ? 0 : 1.0
+        eventNumber: 0, clickCount: clickCount, pressure: isRelease ? 0 : 1.0
     ), let cg = ns.cgEvent else { return nil }
     return cg
 }
@@ -139,6 +141,12 @@ func postPerPid(_ event: CGEvent, pid: Int32, at point: CGPoint, windowNumber: I
         event.setIntegerValueField(.mouseEventWindowUnderMousePointerThatCanHandleThisEvent, value: Int64(windowNumber))
     }
     // Private SPIs: window-local point + Chromium pid latch (field 40).
+    // NOTE: setWindowLoc expects window-LOCAL coordinates, but we pass the screen-global
+    // point. For AppKit apps this is correct (AppKit hit-tests use NSEvent.location which
+    // is global/flipped). For Chromium's internal windowLocation field this may be offset
+    // by the window origin — but field-40 (pid latch) is sufficient for Chromium to accept
+    // the event in practice. Full window-origin subtraction would require threading bounds
+    // through the Input struct (future improvement).
     setWindowLoc?(event, point)
     setIntField?(event, 40, Int64(pid))
     event.timestamp = clock_gettime_nsec_np(CLOCK_UPTIME_RAW)
@@ -152,9 +160,11 @@ func postHidTap(_ event: CGEvent) {
 }
 
 /// True if the target pid is the frontmost app (canvas/GPU apps filter per-pid
-/// routes — must use HID-tap there).
+/// routes — must use HID-tap there). Uses NSWorkspace.frontmostApplication for
+/// an unambiguous "is this pid frontmost right now" check (isActive is unreliable
+/// for LSUIElement/agent processes like SystemUIServer).
 func isFrontmost(_ pid: Int32) -> Bool {
-    return NSRunningApplication(processIdentifier: pid)?.isActive == true
+    return NSWorkspace.shared.frontmostApplication?.processIdentifier == pid
 }
 
 // MARK: - Focus-without-raise (SLPSPostEventRecordTo)
@@ -190,6 +200,24 @@ func focusWithoutRaise(pid: Int32, windowID: Int) {
     _ = targetPSN.withUnsafeBytes { psnRaw in buf.withUnsafeBufferPointer { bp in postRec(psnRaw.baseAddress!, bp.baseAddress!) } }
 }
 
+/// Chromium user-activation primer: leading mouseMoved + off-screen click at (-1,-1).
+/// Required before any real mouse event on Chromium/Electron targets, otherwise
+/// the renderer's user-activation gate filters the event silently.
+/// Called by doClick, doDoubleClick, doDrag before their target events.
+func primeTarget(pid: Int32, at loc: CGPoint, button: CGMouseButton, windowNumber winNum: Int) {
+    // Leading mouseMoved at target (cursor-state primer).
+    if let mv = makeMouseEvent(.mouseMoved, at: loc, button: button, windowNumber: winNum) {
+        postPerPid(mv, pid: pid, at: loc, windowNumber: winNum, button: button); usleep(15_000)
+    }
+    // Off-screen primer click @ (-1,-1) — satisfies Chromium user-activation gate.
+    let off = CGPoint(x: -1, y: -1)
+    if let pd = makeMouseEvent(.leftMouseDown, at: off, button: .left, windowNumber: winNum),
+       let pu = makeMouseEvent(.leftMouseUp, at: off, button: .left, windowNumber: winNum) {
+        postPerPid(pd, pid: pid, at: off, windowNumber: winNum); usleep(1_000)
+        postPerPid(pu, pid: pid, at: off, windowNumber: winNum); usleep(100_000)
+    }
+}
+
 // MARK: - AX keepalive (root-cause fix for Electron/Tauri AXPress silent failure)
 
 /// Keep the target app's AX tree alive when occluded/background.
@@ -234,17 +262,7 @@ func doClick(_ p: Input) -> String {
         return "{\"ok\":true,\"method\":\"hid-tap\"}"
     }
     focusWithoutRaise(pid: pid, windowID: winNum)
-    // Leading mouseMoved at target (cursor-state primer).
-    if let mv = makeMouseEvent(.mouseMoved, at: loc, button: b, windowNumber: winNum) {
-        postPerPid(mv, pid: pid, at: loc, windowNumber: winNum, button: b); usleep(15_000)
-    }
-    // Off-screen primer click @ (-1,-1) — satisfies Chromium user-activation gate.
-    let off = CGPoint(x: -1, y: -1)
-    if let pd = makeMouseEvent(.leftMouseDown, at: off, button: .left, windowNumber: winNum),
-       let pu = makeMouseEvent(.leftMouseUp, at: off, button: .left, windowNumber: winNum) {
-        postPerPid(pd, pid: pid, at: off, windowNumber: winNum); usleep(1_000)
-        postPerPid(pu, pid: pid, at: off, windowNumber: winNum); usleep(100_000)
-    }
+    primeTarget(pid: pid, at: loc, button: b, windowNumber: winNum)
     // Target click.
     guard let dn = makeMouseEvent(downT(b), at: loc, button: b, windowNumber: winNum),
           let up = makeMouseEvent(upT(b), at: loc, button: b, windowNumber: winNum)
@@ -263,6 +281,7 @@ func doDoubleClick(_ p: Input) -> String {
         return hidTapDouble(loc: loc, b: b)
     }
     focusWithoutRaise(pid: pid, windowID: winNum)
+    primeTarget(pid: pid, at: loc, button: b, windowNumber: winNum)
     for state in [1, 2] {
         guard let dn = makeMouseEvent(downT(b), at: loc, button: b, clickCount: state, windowNumber: winNum),
               let up = makeMouseEvent(upT(b), at: loc, button: b, clickCount: state, windowNumber: winNum)
@@ -324,6 +343,7 @@ func doDrag(_ p: Input) -> String {
         return "{\"ok\":true,\"method\":\"hid-tap\"}"
     }
     focusWithoutRaise(pid: pid, windowID: winNum)
+    primeTarget(pid: pid, at: from, button: b, windowNumber: winNum)
     guard let dn = makeMouseEvent(downT(b), at: from, button: b, windowNumber: winNum)
     else { return "{\"error\":\"fail\"}" }
     postPerPid(dn, pid: pid, at: from, windowNumber: winNum, button: b)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucu-mcp",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "MCP server for Universal Computer Use — desktop automation for AI agents via Model Context Protocol",
   "type": "module",
   "bin": {