nezumi/9router
1
0
Fork 0
mirror of https://github.com/Nezumi-2711/9router.git synced 2026-09-22 20:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug

Browse Source
This commit is contained in:
decolua
2026-05-13 20:35:42 +07:00
parent 7f7b86f70e
commit 992f4db4a0
8 changed files with 73 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/mcp/stdioSseBridge.js
+11 -3
View File
@@ -5,7 +5,7 @@ const { spawn } = require("child_process");
const fs = require("fs");
const path = require("path");
const crypto = require("crypto");
const { LOCAL_STDIO_PLUGINS } = require("@/shared/constants/coworkPlugins");
const { LOCAL_STDIO_PLUGINS, ALLOWED_MCP_COMMANDS } = require("@/shared/constants/coworkPlugins");
const { DATA_DIR } = require("@/lib/dataDir");
const CUSTOM_FILE = path.join(DATA_DIR, "mcp", "customPlugins.json");
@@ -111,18 +111,26 @@ const getCustomStore = () => {
return globalThis.__9routerCustomPlugins;
};
function isAllowedCommand(cmd) {
const bin = path.basename(String(cmd || ""));
return ALLOWED_MCP_COMMANDS.has(bin);
}
function registerCustomPlugin(def) {
if (!isAllowedCommand(def?.command)) {
throw new Error(`Blocked: command '${def?.command}' not in MCP allowlist`);
}
getCustomStore().set(def.name, def);
}
function findPlugin(name) {
const fromMem = getCustomStore().get(name) || LOCAL_STDIO_PLUGINS.find((p) => p.name === name);
if (fromMem) return fromMem;
// Lazy-load custom plugins from disk (survives app restart).
// Lazy-load custom plugins from disk (survives app restart); re-validate allowlist.
try {
const list = JSON.parse(fs.readFileSync(CUSTOM_FILE, "utf-8"));
const def = Array.isArray(list) ? list.find((p) => p.name === name && p.command) : null;
if (def) { getCustomStore().set(def.name, def); return def; }
if (def && isAllowedCommand(def.command)) { getCustomStore().set(def.name, def); return def; }
} catch { /* file missing or invalid */ }
return null;
}