fix(security): custom-profile category expansion, record-prune table-id mismatch, exit-intent ownership, adm-zip 0.5.x zip-bomb, Ajv URI parser

Six findings from the PR #22 acceptance audit. Each is reproduced before fixing and pinned by a regression test.

extension tool-profile: startup and file-to-settings sync now preserve the server's fail-closed semantics for post-legacy categories. An older custom profile with no explicit keys for a later-added category's tools was silently widened to include that category when VS Code's package defaults rewrote the file first. Now

Author: ARHAEEM

CHANGELOG.md

@@ -6,6 +6,33 @@ Check [Keep a Changelog](http://keepachangelog.com/) for recommendations on how
 
 ## [Unreleased]
 
+### Fixed — PR #22 acceptance audit follow-ups (2026-08-01)
+
+- **Existing custom profiles stay closed when a category is added.** The MCP server already
+  treated absent tools in post-legacy categories as disabled, but extension startup rewrote the
+  same file from VS Code's package defaults first — silently enabling `local-write`. Startup and
+  file-to-settings sync now preserve the server's fail-closed semantics, including mixed per-tool
+  states, and a later category toggle clears those imported overrides before applying the user's
+  explicit choice.
+- **Record-prune failure accounting now follows destination table IDs.** Per-table write results
+  were stored under the source table name but read back under the destination table name, so a
+  renamed matched table could lose the all-writes-failed no-prune guard. A regression test runs the
+  write and prune phases together with differing names.
+- **Daemon exit intents have request ownership.** An older concurrent `/mcp` response could finish
+  after `manage_daemon stop` staged its process-wide intent, steal it, and begin shutdown before the
+  stop confirmation flushed. `AsyncLocalStorage` now binds the intent to the response that staged
+  it, with a deterministic two-request regression test.
+- **Session restore no longer bundles vulnerable `adm-zip` 0.5.x.** A tiny crafted archive could
+  declare a multi-gigabyte uncompressed entry and crash the extension host before CRC validation.
+  The bundled parser is now 0.6.0, the restore picker size-checks before reading only the encryption
+  header, and declared uncompressed totals are rejected before entry allocation.
+- **The shipped Ajv URI parser is patched without widening the dependency refresh.** The lockfile
+  moves `fast-uri` 3.1.0 → 3.1.5 through the existing MCP SDK dependency, clearing its four
+  production audit findings while leaving the SDK and browser-auth stack pinned.
+- Corrected the live tool references to list 9 read tools and 2 local-file-write tools, completed
+  the dashboard's early-activation category fallback, and removed stale secret-bearing login CLI
+  examples and an inapplicable `login.json` hint.
+
 ### Fixed — formula diagnostics were quadratic, blocking the editor on every keystroke (2026-07-31)
 
 - **`isInsideExclusionRange` was a linear scan run once per character.** `ranges.some(...)` is

CLAUDE.md

@@ -268,7 +268,7 @@ Located at `packages/mcp-server/dev-tools/` (gitignored):
 All under `airtableFormula.*`:
 - `mcp.autoConfigureOnInstall` — auto-write MCP config to detected IDEs on first launch
 - `mcp.toolProfile` — `read-only` (10 tools) / `safe-write` (54 tools) / `full` (72 tools) / `custom`
-- `mcp.categories.{read,recordRead,recordWrite,recordDestructive,tableWrite,tableDestructive,fieldWrite,fieldDestructive,viewWrite,viewDestructive,viewSection,viewSectionDestructive,formWrite,extension,sync,daemon,localWrite}` — per-category toggles when profile is `custom`. `sync`, `recordDestructive` and `daemon` default to **off**; the other 13 default to on.
+- `mcp.categories.{read,recordRead,recordWrite,recordDestructive,tableWrite,tableDestructive,fieldWrite,fieldDestructive,viewWrite,viewDestructive,viewSection,viewSectionDestructive,formWrite,extension,sync,daemon,localWrite}` — per-category toggles when profile is `custom`. `sync`, `recordDestructive` and `daemon` default to **off**; the other 14 default to on.
 - `mcp.daemonPort` — fixed TCP port for the shared MCP daemon HTTP server (default 8723, kept stable across restarts; 0 = automatic/ephemeral; falls back to an automatic port if the chosen port is busy; takes effect on next daemon restart)
 - `mcp.authMode` — `browser` (default; headless Chrome mints the cookie, calls go direct-HTTP) / `byo` (cookie-only, no browser; cookie from `~/.airtable-user-mcp/credentials.json` or `AIRTABLE_COOKIE`) / `direct-login` (browser-free email+password+TOTP; `login.json` or `AIRTABLE_EMAIL/PASSWORD/TOTP_SECRET`). Injected as `AIRTABLE_AUTH_MODE` into the spawned server via `buildDaemonEnv`/`registration.ts` (non-default only). Takes effect on next daemon/server restart.
 - `mcp.httpClient` — `fetch` (default) / `impit` (Chrome-TLS impersonation fallback). Injected as `AIRTABLE_HTTP_CLIENT`. `impit` must be available to the server (optionalDependency; add to the vendored deps for the bundled path).

README.md

@@ -198,7 +198,8 @@ Manage Airtable bases with capabilities **not available through the official RES
 
 | Category | Tools | Highlights |
 |:---------|:-----:|:-----------|
-| **Schema Read** | 11 | Full schema inspection — bases, tables, fields, views, sidebar sections, record templates; download all formula fields to local files |
+| **Schema Read** | 9 | Full schema inspection — bases, tables, fields, views, sidebar sections, record templates |
+| **Local File Write** | 2 | Download one formula field or every formula in a base to caller-chosen `.formula` files; excluded from `read-only` |
 | **Record Read** | 1 | `query_records` — up to 1 000 records/call with resolved field values; `search` param works on lookup/rollup fields (REST API `filterByFormula` doesn't) |
 | **Record Write** | 4 | `create_records` / `update_records` / `duplicate_records` / `upload_attachment` (the only way to write `multipleAttachments` cells by URL) |
 | **Record Destructive** | 1 | `delete_records` — batch-delete records from a table |

packages/extension/package.json

@@ -541,7 +541,7 @@
         "airtableFormula.mcp.categories.read": {
           "type": "boolean",
           "default": true,
-          "description": "Read / Inspect tools: get_base_schema, list_tables, get_table_schema, list_fields, list_views, get_view, validate_formula, list_view_sections."
+          "description": "Read / Inspect tools: get_base_schema, list_tables, get_table_schema, list_fields, list_views, get_view, validate_formula, list_view_sections, list_record_templates."
         },
         "airtableFormula.mcp.categories.tableWrite": {
           "type": "boolean",
@@ -760,7 +760,7 @@
     "@types/vscode": "^1.100.0",
     "@vscode/test-electron": "^2.4.0",
     "@vscode/vsce": "^3.0.0",
-    "adm-zip": "^0.5.17",
+    "adm-zip": "^0.6.0",
     "airtable-user-mcp": "workspace:*",
     "archiver": "^7.0.1",
     "tsup": "^8.0.0",

packages/extension/src/mcp/session-backup.ts

@@ -19,6 +19,13 @@ const CONFIG_DIR = path.join(os.homedir(), '.airtable-user-mcp');
 const MAX_BACKUP_FILE_BYTES = 200 * 1024 * 1024;    // 200 MB on-disk
 const MAX_UNZIPPED_BYTES    = 500 * 1024 * 1024;    // 500 MB post-extraction
 
+async function assertBackupFileSize(srcPath: string): Promise<void> {
+  const stat = await fs.stat(srcPath);
+  if (stat.size > MAX_BACKUP_FILE_BYTES) {
+    throw new Error(`Backup file is too large (${stat.size} bytes, max ${MAX_BACKUP_FILE_BYTES}).`);
+  }
+}
+
 export async function backupSession(destPath: string, password?: string): Promise<void> {
   const zipBuffer = await createZipBuffer(CONFIG_DIR);
 
@@ -53,10 +60,7 @@ function parseEncryptedHeader(data: Buffer): BackupHeader {
 export async function restoreSession(srcPath: string, password?: string): Promise<void> {
   // H1 — size guard. stat before reading so a 4 GB attacker file doesn't OOM
   // the extension host.
-  const stat = await fs.stat(srcPath);
-  if (stat.size > MAX_BACKUP_FILE_BYTES) {
-    throw new Error(`Backup file is too large (${stat.size} bytes, max ${MAX_BACKUP_FILE_BYTES}).`);
-  }
+  await assertBackupFileSize(srcPath);
 
   const fileData = await fs.readFile(srcPath);
 
@@ -106,7 +110,14 @@ export async function restoreSession(srcPath: string, password?: string): Promis
         continue;
       }
 
-      // Track uncompressed size to guard against zip-bombs.
+      // Reject from the central-directory size before getData() allocates the
+      // decompressed buffer. adm-zip validates/caps the actual output; the
+      // post-read check below remains defense in depth for malformed metadata.
+      const declaredSize = entry.header.size;
+      if (!Number.isSafeInteger(declaredSize) || declaredSize < 0 || declaredSize > MAX_UNZIPPED_BYTES - totalSize) {
+        throw new Error(`Backup rejected: uncompressed size exceeds ${MAX_UNZIPPED_BYTES} bytes (possible zip-bomb).`);
+      }
+
       const data = entry.getData();
       totalSize += data.length;
       if (totalSize > MAX_UNZIPPED_BYTES) {
@@ -155,6 +166,20 @@ export function isEncryptedFile(data: Buffer): boolean {
   return isEncrypted(data);
 }
 
+/** Check a selected backup without reading the entire file into memory. */
+export async function isEncryptedBackupFile(srcPath: string): Promise<boolean> {
+  await assertBackupFileSize(srcPath);
+
+  const handle = await fs.open(srcPath, 'r');
+  try {
+    const header = Buffer.alloc(MAGIC.length);
+    const { bytesRead } = await handle.read(header, 0, header.length, 0);
+    return isEncrypted(header.subarray(0, bytesRead));
+  } finally {
+    await handle.close();
+  }
+}
+
 function isEncrypted(data: Buffer): boolean {
   return data.length >= 4 && data.subarray(0, 4).equals(MAGIC);
 }