You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Bare JSON scalar on the MCPL wire kills the host (uncaught TypeError in the line dispatcher) #217
Severity: P1 — remote host-kill on the deploy runtime.
src/mcpl/server-connection.ts (setupMessageRouting, ~line 1117): the try/catch covers only JSON.parse; the first use of the parsed value is 'id' in msg. A wire line that parses to a non-object — null, 42, "hi", true — throws TypeError: Cannot use 'in' operator to search for 'id' in null out of the transport's 'line' listener.
Verified end-to-end with the real StdioTransport + McplServerConnection and a child printing null\n followed by a valid notification: uncaught exception, host exit 1, the second line never delivered — identical on node 20 and bun 1.3.14 (connectome-host's pinned runtime; it installs no uncaughtException handler). Any connected MCPL server can terminate the host and every resident with a single line.
Pre-existing at least as far back as 03c31d9 — not introduced by #208, but it is the same containment boundary; see the ask in my #208 review (two-line fix + revert-goes-red test: guard non-object messages, last-resort try/catch around the post-parse dispatch, test sending null then a valid notification).
Related, lower severity, found in the same read: mcpl/manifestChanged and tools/list_changed sent as Requests (with an id) are dispatched to listeners that take no responder, so the request is never answered and a conforming server hangs (§6.6 answer-or-error).
Found during review of #208; probes by both panel Wefts, reproduced independently.
Activity
docs(changelog): anima-research#208's note describes the change from …
fix(mcpl): an initialize error whose message has no string form refus…