@ai-ecoverse/mcpcat 0.17.5 → 0.17.7

package/README.md

@@ -26,14 +26,12 @@ mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Slicc
 
 ## Releases: certified = latest
 
-Every change that alters what mcpcat ships is certified before it reaches `main`. A pull request that touches `src/`, the build, the dependencies or the release workflows gets mcpcat's cert-review on a pack of its head, and again in the merge queue on the exact tree that lands on `main`; a FAIL blocks the merge. Docs-, test- and CI-only changes skip it as "not behaviour". A draft pull request is not reviewed: its `cert-review` is red with `draft: not reviewed, mark it ready for review`, and marking it ready starts the review (converted_to_draft cancels a running one). Mark ready = reviewed, and merges on green; a pull request held for anything stays a draft. For a PR that needs the coordinator's security read, the order is: the coordinator reads the draft, it is marked ready, the cert runs, then the queue. Each merge to `main` is then released to npm as `latest` in one step by semantic-release, with provenance, so `npm install @ai-ecoverse/mcpcat` and the installer always get certified code. The verdict line is a comment on the pull request and the `cert-review` commit status. It reads `certified …`, `cert-ci: FAIL …` when the reviewer or a check in code found a defect (status `failure`), or `cert-ci: INCOMPLETE …` when the review couldn't decide: the review job didn't succeed or was skipped, no verdict could be read, or the artifact or the runner's own `gh` was missing (status `error`). A fork's change to shipped behaviour also reads INCOMPLETE, since it gets no review. INCOMPLETE never certifies; re-run the failed jobs. A run that ends without `record` posting its status (a crashed plan, record or verdict job) still posts one on the head: `error` with its INCOMPLETE line, `failure` for a FAIL, or `pending` while the coordinator approval is missing. So the required `cert-review` check never waits forever, and a label change reuses only a `success` or `failure` verdict, never an INCOMPLETE one. The reviewer's verdict can add defects but never clear one found in code: `record` re-reads the suites' evidence (`stage.json`, `suites.json`), uploaded before the reviewer runs and bound by the artifact id and digest the review job output. A suite or security row that failed on the host or a pinned kernel, a changed test that fails on the head, an import in the kernel bundle or an unexplained rebuild difference is a FAIL. Missing suites, kernels or rows are INCOMPLETE. The NEGATIVE runs each changed test on the base's code: the subject's tests, helpers and fixtures with the base's `dist`, `scripts/` and `.github/workflows/`, all from the base sha, so a test of the cert tooling runs against main's tooling. The record names both shas. A changed test that also passes on the base is named in the line as `gaps: no-negative <file>`. Every artifact a later job reads (the tarball, the verdict, the suites' evidence) is downloaded by the artifact id its producer output, after `bind.mjs` checks the artifact's name, run and digest against that producer's outputs. Any other artifact from this attempt of the run under `mcpcat-tarball-`, `mcpcat-npm-tarball-` or `cert-review-` makes the line INCOMPLETE. An earlier attempt's leftovers, created before this attempt started, are never read.
+Every change that alters what mcpcat ships is certified before it reaches `main`. A pull request that touches `src/`, the build, the dependencies or the release workflows gets mcpcat's cert-review on a pack of its head, and again in the merge queue on the exact tree that lands on `main`; a FAIL blocks the merge. Docs-, test- and CI-only changes skip it as "not behaviour". A draft pull request is not reviewed: its `cert-review` is red with `draft: not reviewed, mark it ready for review`, and marking it ready starts the review (converted_to_draft cancels a running one). Mark ready = reviewed, and merges on green; a pull request held for anything stays a draft. For a PR that needs the coordinator's security read, the order is: the coordinator reads the draft, it is marked ready, the cert runs, then the queue. Each merge to `main` is then released to npm as `latest` in one step by semantic-release, with provenance, so `npm install @ai-ecoverse/mcpcat` and the installer always get certified code. The verdict line is a comment on the pull request and the `cert-review` commit status. It reads `certified …`, `cert-ci: FAIL …` when the reviewer or a check in code found a defect (status `failure`), or `cert-ci: INCOMPLETE …` when the review couldn't decide: the review job didn't succeed or was skipped, no verdict could be read, or the artifact or the runner's own `gh` was missing (status `error`). A fork's change to shipped behaviour also reads INCOMPLETE, since it gets no review. INCOMPLETE never certifies; re-run the failed jobs. A run that ends without `record` posting its status (a crashed plan, record or verdict job) still posts one on the head: `error` with its INCOMPLETE line, or `failure` for a FAIL. So the required `cert-review` check never waits forever. The reviewer's verdict can add defects but never clear one found in code: `record` re-reads the suites' evidence (`stage.json`, `suites.json`), uploaded before the reviewer runs and bound by the artifact id and digest the review job output. A suite or security row that failed on the host or a pinned kernel, a changed test that fails on the head, an import in the kernel bundle or an unexplained rebuild difference is a FAIL. Missing suites, kernels or rows are INCOMPLETE. The NEGATIVE runs each changed test on the base's code: the subject's tests, helpers and fixtures with the base's `dist`, `scripts/` and `.github/workflows/`, all from the base sha, so a test of the cert tooling runs against main's tooling. The record names both shas. A changed test that also passes on the base is named in the line as `gaps: no-negative <file>`. Every artifact a later job reads (the tarball, the verdict, the suites' evidence) is downloaded by the artifact id its producer output, after `bind.mjs` checks the artifact's name, run and digest against that producer's outputs. Any other artifact from this attempt of the run under `mcpcat-tarball-`, `mcpcat-npm-tarball-` or `cert-review-` makes the line INCOMPLETE. An earlier attempt's leftovers, created before this attempt started, are never read.
 
 After each release, `cert-verify.yml` (on the Release run's success, or dispatched from `main` with a `version`) checks again that npm serves the SLSA subject built by `release.yml` on `main` from the tag, and that every pull request merged since the previous tag carries a green `cert-review` status on its head. Its hosted, write-only `notes` job then puts one line into the GitHub release notes, between `<!-- cert-verify -->` markers: `certified @ai-ecoverse/mcpcat@<version> sha256=<sha> (…; pr-certified since v<prev>: …)`, or `verified …` when some pull request lacks a green cert-review. A re-run with the same bytes leaves the notes as they are. Notes that already name another sha for the version, or npm bytes that don't verify, are a supply-chain alert: nothing is written and an issue is filed. Checks that couldn't run read `cert-ci: INCOMPLETE` and write nothing.
 
 Silence never passes: every gate in the workflows prints a verdict line, and its caller requires that line, not just an exit code. These are `all-green: PASS|FAIL …`, the cert job's `cert: kernel <v> — N kernel tests passed`, shipped.mjs's `behaviour:`/`not behaviour:`, release verify's `verified …`, and the installer tests' `All installer tests passed.`. A gate that exits 0 without its line fails.
 
-A pull request or merge group that touches the certification itself (the `cert-review` and `ci` workflows, `scripts/cert-review/` and `rows.json`, `scripts/cert.mjs`, `scripts/kernel-test-files.mjs`, and the cert-row, cert-gate, cert-review, cert-runner, cert-self-guard, cert-verify and cert-verdicts tests) fails `cert-review` with "needs coordinator review" until the label `cert-review-approved` is applied after its head arrived. The check is the shared [cert self-guard](https://github.com/ai-ecoverse/slicc-shared-web/tree/f342d7cf558c817ce517bbbbc4cc46df6eac2f97/.github/actions/cert-self-guard), pinned to a full sha in `cert-review.yml`. Only the lane coordinator applies the label, after reading the diff; workers never add or remove it. Any push removes it, so every new head needs a fresh approval; a label change re-runs the checks but reuses the recorded cert-review verdict of an unchanged head. To re-check an approval, run the label event, not the earlier push. The label is procedural: every agent acts as one admin account, so the permission check cannot tell a coordinator from a worker, and a deliberate rewrite of the workflow is not stopped. The `kernel-cert-*` pins in `package.json` are not guarded, because the guard matches whole files and guarding `package.json` would hold every Renovate bump for approval.
-
 ## Quick start
 
 ```sh

package/dist/host/mcpcat.mjs

@@ -9855,6 +9855,15 @@ function containsPlaceholders(value) {
 function expandPlaceholders(value, env) {
   return value.replace(PLACEHOLDER, (_, name) => env[name] ?? "");
 }
+var MIN_VAR_SECRET = 8;
+function placeholderValues(value, env) {
+  const values = [];
+  for (const m of value.matchAll(PLACEHOLDER)) {
+    const v = env[m[1]];
+    if (v !== void 0 && v.length >= MIN_VAR_SECRET) values.push(v);
+  }
+  return values;
+}
 function missingPlaceholders(value, env) {
   const missing = [];
   for (const m of value.matchAll(PLACEHOLDER)) {
@@ -11147,6 +11156,29 @@ async function runDiscover(platform2, args2) {
   return 0;
 }
 
+// src/render/redact.ts
+function redactDeep(value, redact2) {
+  if (typeof value === "string") return redact2(value);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, redact2));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [redact2(k), redactDeep(v, redact2)])
+    );
+  }
+  return value;
+}
+function redactWrites(platform2, redact2) {
+  return Object.assign(Object.create(platform2), {
+    write: (fd, data) => platform2.write(fd, typeof data === "string" ? redact2(data) : data)
+  });
+}
+function redactSecrets(text, secrets) {
+  const ordered = [...secrets].filter((s) => s.length > 0).sort((a, b) => b.length - a.length);
+  let result = text;
+  for (const secret of ordered) result = result.replaceAll(secret, "[REDACTED]");
+  return result;
+}
+
 // src/render/result.ts
 function formatBytes(n) {
   if (n < 1024) return `${n} bytes`;
@@ -15345,15 +15377,7 @@ function isSensitiveHeader(name) {
   return SENSITIVE_HEADER_RE.test(name) || SENSITIVE_NAME_RE.test(name);
 }
 function redact(text, secrets) {
-  let result = text;
-  for (const secret of secrets) {
-    if (secret.length > 0) {
-      while (result.includes(secret)) {
-        result = result.replace(secret, "[REDACTED]");
-      }
-    }
-  }
-  return result;
+  return redactSecrets(text, secrets);
 }
 function createVerboseLogger(platform2, enabled) {
   const secrets = /* @__PURE__ */ new Set();
@@ -16431,7 +16455,7 @@ function expandAndCollect(headers, env) {
     }
     const e = expandPlaceholders(v, env);
     result[k] = e;
-    if (e !== v) secrets.push(e);
+    if (e !== v) secrets.push(e, ...placeholderValues(v, env));
     if (v.length > 0) secrets.push(v);
   }
   return { expanded: result, secrets, unset };
@@ -16542,18 +16566,24 @@ async function loadRespondData(platform2, respondArg, json) {
     return { exitCode: EXIT_USAGE };
   }
 }
-async function handleInputRequired(platform2, conn, err, respondData, json) {
+async function handleInputRequired(platform2, conn, err, respondData, json, redact2) {
   const parsed2 = JSON.parse(err.requestJson);
+  const requestOut = sanitizeJson(JSON.stringify(redactDeep(parsed2, redact2), null, 2));
   const inputReq = parseInputRequest(parsed2.result ?? parsed2);
   if (!inputReq) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
   const isTty = platform2.kind === "host" && platform2.isatty(0) && platform2.isatty(2);
-  const elicitResult = await handleElicitation(platform2, inputReq, isTty, respondData);
+  const elicitResult = await handleElicitation(
+    redactWrites(platform2, redact2),
+    inputReq,
+    isTty,
+    respondData
+  );
   if ("exitCode" in elicitResult) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
@@ -16565,7 +16595,7 @@ async function handleInputRequired(platform2, conn, err, respondData, json) {
     return renderCallResult(platform2, retryResult, { json });
   } catch (retryErr) {
     const e2 = classifyError(retryErr);
-    await writeErr(platform2, json, e2.kind, e2.msg);
+    await writeErrRedacted(platform2, json, e2.kind, e2.msg, redact2);
     return e2.code;
   }
 }
@@ -16638,17 +16668,7 @@ async function runClientVerb(platform2, version, parsed) {
   const configSecrets = collectConfigSecrets(resolved.headers, platform2.env);
   for (const s of configSecrets) verbose.secrets.add(s);
   const allSecrets = /* @__PURE__ */ new Set([...secrets, ...configSecrets]);
-  const redact2 = (text) => {
-    let result = text;
-    for (const secret of allSecrets) {
-      if (secret.length > 0) {
-        while (result.includes(secret)) {
-          result = result.replace(secret, "[REDACTED]");
-        }
-      }
-    }
-    return result;
-  };
+  const redact2 = (text) => redactSecrets(text, allSecrets);
   const mergedHeaders = { ...configHeaders, ...expanded };
   const hasAuthHeader = "Authorization" in mergedHeaders;
   const authResolved = await resolveAuthProvider(
@@ -16723,7 +16743,7 @@ async function runClientVerb(platform2, version, parsed) {
       return termExitCode;
     }
     if (err instanceof InputRequiredError) {
-      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput);
+      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput, redact2);
     }
     const e = classifyError(err);
     await writeErrRedacted(platform2, parsed.jsonOutput, e.kind, e.msg, redact2);
@@ -16759,7 +16779,7 @@ function collectConfigSecrets(headers, env) {
   const secrets = [];
   for (const [, v] of Object.entries(headers)) {
     const expanded = expandPlaceholders(v, env);
-    if (expanded !== v && expanded.length > 0) secrets.push(expanded);
+    if (expanded !== v && expanded.length > 0) secrets.push(expanded, ...placeholderValues(v, env));
     if (v.length > 0 && v !== expanded) secrets.push(v);
   }
   return secrets;
@@ -17025,5 +17045,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.17.5", args);
+var code = await run(platform, "0.17.7", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -9476,6 +9476,15 @@ function containsPlaceholders(value) {
 function expandPlaceholders(value, env2) {
   return value.replace(PLACEHOLDER, (_, name) => env2[name] ?? "");
 }
+var MIN_VAR_SECRET = 8;
+function placeholderValues(value, env2) {
+  const values = [];
+  for (const m of value.matchAll(PLACEHOLDER)) {
+    const v = env2[m[1]];
+    if (v !== void 0 && v.length >= MIN_VAR_SECRET) values.push(v);
+  }
+  return values;
+}
 function missingPlaceholders(value, env2) {
   const missing = [];
   for (const m of value.matchAll(PLACEHOLDER)) {
@@ -10768,6 +10777,29 @@ async function runDiscover(platform2, args) {
   return 0;
 }
 
+// src/render/redact.ts
+function redactDeep(value, redact2) {
+  if (typeof value === "string") return redact2(value);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, redact2));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [redact2(k), redactDeep(v, redact2)])
+    );
+  }
+  return value;
+}
+function redactWrites(platform2, redact2) {
+  return Object.assign(Object.create(platform2), {
+    write: (fd, data) => platform2.write(fd, typeof data === "string" ? redact2(data) : data)
+  });
+}
+function redactSecrets(text, secrets) {
+  const ordered = [...secrets].filter((s) => s.length > 0).sort((a, b) => b.length - a.length);
+  let result = text;
+  for (const secret of ordered) result = result.replaceAll(secret, "[REDACTED]");
+  return result;
+}
+
 // src/render/result.ts
 function formatBytes(n) {
   if (n < 1024) return `${n} bytes`;
@@ -14966,15 +14998,7 @@ function isSensitiveHeader(name) {
   return SENSITIVE_HEADER_RE.test(name) || SENSITIVE_NAME_RE.test(name);
 }
 function redact(text, secrets) {
-  let result = text;
-  for (const secret of secrets) {
-    if (secret.length > 0) {
-      while (result.includes(secret)) {
-        result = result.replace(secret, "[REDACTED]");
-      }
-    }
-  }
-  return result;
+  return redactSecrets(text, secrets);
 }
 function createVerboseLogger(platform2, enabled) {
   const secrets = /* @__PURE__ */ new Set();
@@ -16052,7 +16076,7 @@ function expandAndCollect(headers, env2) {
     }
     const e = expandPlaceholders(v, env2);
     result[k] = e;
-    if (e !== v) secrets.push(e);
+    if (e !== v) secrets.push(e, ...placeholderValues(v, env2));
     if (v.length > 0) secrets.push(v);
   }
   return { expanded: result, secrets, unset };
@@ -16163,18 +16187,24 @@ async function loadRespondData(platform2, respondArg, json) {
     return { exitCode: EXIT_USAGE };
   }
 }
-async function handleInputRequired(platform2, conn, err, respondData, json) {
+async function handleInputRequired(platform2, conn, err, respondData, json, redact2) {
   const parsed2 = JSON.parse(err.requestJson);
+  const requestOut = sanitizeJson(JSON.stringify(redactDeep(parsed2, redact2), null, 2));
   const inputReq = parseInputRequest(parsed2.result ?? parsed2);
   if (!inputReq) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
   const isTty = platform2.kind === "host" && platform2.isatty(0) && platform2.isatty(2);
-  const elicitResult = await handleElicitation(platform2, inputReq, isTty, respondData);
+  const elicitResult = await handleElicitation(
+    redactWrites(platform2, redact2),
+    inputReq,
+    isTty,
+    respondData
+  );
   if ("exitCode" in elicitResult) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
@@ -16186,7 +16216,7 @@ async function handleInputRequired(platform2, conn, err, respondData, json) {
     return renderCallResult(platform2, retryResult, { json });
   } catch (retryErr) {
     const e2 = classifyError(retryErr);
-    await writeErr(platform2, json, e2.kind, e2.msg);
+    await writeErrRedacted(platform2, json, e2.kind, e2.msg, redact2);
     return e2.code;
   }
 }
@@ -16259,17 +16289,7 @@ async function runClientVerb(platform2, version, parsed) {
   const configSecrets = collectConfigSecrets(resolved.headers, platform2.env);
   for (const s of configSecrets) verbose.secrets.add(s);
   const allSecrets = /* @__PURE__ */ new Set([...secrets, ...configSecrets]);
-  const redact2 = (text) => {
-    let result = text;
-    for (const secret of allSecrets) {
-      if (secret.length > 0) {
-        while (result.includes(secret)) {
-          result = result.replace(secret, "[REDACTED]");
-        }
-      }
-    }
-    return result;
-  };
+  const redact2 = (text) => redactSecrets(text, allSecrets);
   const mergedHeaders = { ...configHeaders, ...expanded };
   const hasAuthHeader = "Authorization" in mergedHeaders;
   const authResolved = await resolveAuthProvider(
@@ -16344,7 +16364,7 @@ async function runClientVerb(platform2, version, parsed) {
       return termExitCode;
     }
     if (err instanceof InputRequiredError) {
-      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput);
+      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput, redact2);
     }
     const e = classifyError(err);
     await writeErrRedacted(platform2, parsed.jsonOutput, e.kind, e.msg, redact2);
@@ -16380,7 +16400,7 @@ function collectConfigSecrets(headers, env2) {
   const secrets = [];
   for (const [, v] of Object.entries(headers)) {
     const expanded = expandPlaceholders(v, env2);
-    if (expanded !== v && expanded.length > 0) secrets.push(expanded);
+    if (expanded !== v && expanded.length > 0) secrets.push(expanded, ...placeholderValues(v, env2));
     if (v.length > 0 && v !== expanded) secrets.push(v);
   }
   return secrets;
@@ -16747,7 +16767,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.17.5", args);
+  return run(platform2, "0.17.7", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.17.5",
+  "version": "0.17.7",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",
@@ -61,15 +61,15 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-bios": "1.35.0",
-    "@ai-ecoverse/slicc-kernel": "1.141.2",
-    "@ai-ecoverse/slicc-shared-web": "1.29.2",
+    "@ai-ecoverse/slicc-bios": "1.36.1",
+    "@ai-ecoverse/slicc-kernel": "1.141.3",
+    "@ai-ecoverse/slicc-shared-web": "1.29.8",
     "@biomejs/biome": "2.5.15",
     "@earendil-works/pi-codemode": "1.2.0",
     "@earendil-works/pi-mcp": "1.2.0",
     "@types/node": "26.6.5",
     "esbuild": "0.28.2",
-    "kernel-cert-new": "npm:@ai-ecoverse/slicc-kernel@1.141.2",
+    "kernel-cert-new": "npm:@ai-ecoverse/slicc-kernel@1.141.3",
     "lefthook": "2.2.2",
     "monocart-coverage-reports": "2.13.2",
     "proper-lockfile": "4.1.2",