fix(security): close MCP-surface secret-leak gaps from post-ship review (H1/M1/M3/L1)

[m1ngshum]

Summary

Post-ship security review of main (after #62/#61/#63/#64) found that the #64 MCP hardening — which blocks process.env on the untrusted mcpm_up surface — has gaps that survive it. This PR closes the shipped-diff ones. (Pre-existing items go in a follow-up PR.)

Method: 6-dimension multi-agent review → 2-lens adversarial verification (refute + exploit) → manual confirmation against source.

Findings fixed

ID	Sev	What	Fix
H1	HIGH	up.ts gated process.env (475) but read the CWD .env ungated (172, 476). An attacker-controlled stack file could still siphon the host's .env into an installed server config.	New allowEnvFile option (default true = CLI); handleMcpUp passes false, skipping the .env read entirely.
M3	MED	Path containment used lexical path.resolve only — an in-cwd symlink pointing outside cwd passed, and the reader followed it (out-of-tree read).	realpath re-check after the lexical check (ENOENT-tolerant).
M1	MED	A whole-batch throw pushed its error message into failed[], which is contracted to hold server names — a consumer iterating it got a stray sentence.	Surface batch errors via the error field only; failed[] stays names-only.
L1	LOW	Env resolution used truthiness, dropping legitimate empty-string ("") values.	Compare against undefined.
H2	(test)	The blocked-by-policy test mocked deps.computeTrustScore, which handleMcpUp never calls (it builds its own) — the gate was only exercised by coincidence.	Test now drives the real trust pipeline.

Tests

• New: .env is not harvested on the MCP surface (fails on pre-fix code).
• New: in-cwd symlink pointing outside cwd is rejected.
• Updated: blocked-by-policy now proves the real gate; no-clients asserts error (not poisoned failed).
• Full vitest suite green (1300 tests); tsc --noEmit + tsup clean.

Not in this PR (follow-up)

Pre-existing hardening (http→loopback-only remote URLs, runtime-arg .. rejection, machine-key downgrade warning) and the trust-floor policy decision (M2).

[m1ngshum]

Added M2 to this PR (it edits the same UpOptions/handleUp-options block, so it belongs here rather than the follow-up):

M2 (MED) — trust-floor bypass on mcpm_up. The single-install MCP tool (handleInstall) already clamps installs to a non-overridable HARD_TRUST_FLOOR (issue #24), but the batch mcpm_up path enforced only the stack file's policy — which the untrusted caller controls and can omit or set to minTrustScore: 0. A prompt-injected agent could install a low-trust server via mcpm_up that mcpm_install would reject.

Fix: handleUp gains a minTrustFloor option (default undefined = CLI behavior, no floor); processServer blocks below it before the caller-controlled policy check. handleMcpUp passes the same HARD_TRUST_FLOOR. New test: a score-30 server with no policy is blocked by a floor of 50.

Updated totals: 6 findings in this PR (H1, M1, M2, M3, L1, + H2 test correction). Full suite green (1300 tests), tsc + tsup clean.

[m1ngshum]

Multi-agent review pass — addressed (commit 1d05f43)

Ran a 3-lens review (security/efficacy · correctness · test-proof) with 2-lens adversarial verification. Verdict: approve-with-nits, no blockers — the five fixes close their holes and introduce no new vuln. (The verifier correctly killed two cross-contaminated M4a/M4b false positives — that code lives in #66, not here.) Addressed the real items:

• M3 error-leak — the realpath catch only swallowed ENOENT, so a caller-supplied stackFile that is a circular symlink (ELOOP) or has a file as a path component (ENOTDIR) leaked a raw ErrnoException (with stack) to the untrusted caller. Now treats ENOENT/ELOOP/ENOTDIR alike; the containment Error has no .code so it still propagates.
• M2 wiring coverage — added handlers-up-wiring.test.ts: mocks handleUp and asserts handleMcpUp passes allowProcessEnv/allowEnvFile/allowUrlServers:false and minTrustFloor:25. Deleting the floor from the call site now fails a test (it didn't before).
• Nits: missing-env test asserts failed contains the server name; corrected the H2 comment (real score 55/80 = 69%); documented the absolute-vs-percentage floor as intentional.

Full suite green (1301), tsc + tsup clean.