@ai-ecoverse/mcpcat 0.17.9 → 0.17.10

package/README.md

@@ -28,9 +28,7 @@ mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Slicc
 
 Every change that alters what mcpcat ships is certified before it reaches `main`. A pull request that touches `src/`, the build, the dependencies or the release workflows gets mcpcat's cert-review on a pack of its head, and again in the merge queue on the exact tree that lands on `main`; a FAIL blocks the merge. Docs-, test- and CI-only changes skip it as "not behaviour". A draft pull request is not reviewed: its `cert-review` is red with `draft: not reviewed, mark it ready for review`, and marking it ready starts the review (converted_to_draft cancels a running one). Mark ready = reviewed, and merges on green; a pull request held for anything stays a draft. For a PR that needs the coordinator's security read, the order is: the coordinator reads the draft, it is marked ready, the cert runs, then the queue. Each merge to `main` is then released to npm as `latest` in one step by semantic-release, with provenance, so `npm install @ai-ecoverse/mcpcat` and the installer always get certified code. The verdict line is a comment on the pull request and the `cert-review` commit status. It reads `certified …`, `cert-ci: FAIL …` when the reviewer or a check in code found a defect (status `failure`), or `cert-ci: INCOMPLETE …` when the review couldn't decide: the review job didn't succeed or was skipped, no verdict could be read, or the artifact or the runner's own `gh` was missing (status `error`). A fork's change to shipped behaviour also reads INCOMPLETE, since it gets no review. INCOMPLETE never certifies; re-run the failed jobs. A run that ends without `record` posting its status (a crashed plan, record or verdict job) still posts one on the head: `error` with its INCOMPLETE line, or `failure` for a FAIL. So the required `cert-review` check never waits forever. The reviewer's verdict can add defects but never clear one found in code: `record` re-reads the suites' evidence (`stage.json`, `suites.json`), uploaded before the reviewer runs and bound by the artifact id and digest the review job output. A suite or security row that failed on the host or a pinned kernel, a changed test that fails on the head, an import in the kernel bundle or an unexplained rebuild difference is a FAIL. Missing suites, kernels or rows are INCOMPLETE. The NEGATIVE runs each changed test on the base's code: the subject's tests, helpers and fixtures with the base's `dist`, `scripts/` and `.github/workflows/`, all from the base sha, so a test of the cert tooling runs against main's tooling. The record names both shas. A changed test that also passes on the base is named in the line as `gaps: no-negative <file>`. Every artifact a later job reads (the tarball, the verdict, the suites' evidence) is downloaded by the artifact id its producer output, after `bind.mjs` checks the artifact's name, run and digest against that producer's outputs. Any other artifact from this attempt of the run under `mcpcat-tarball-`, `mcpcat-npm-tarball-` or `cert-review-` makes the line INCOMPLETE. An earlier attempt's leftovers, created before this attempt started, are never read.
 
-After each release, `cert-verify.yml` (on the Release run's success, or dispatched from `main` with a `version`) checks again that npm serves the SLSA subject built by `release.yml` on `main` from the tag, and that every pull request merged since the previous tag carries a green `cert-review` status on its head. Its hosted, write-only `notes` job then puts one line into the GitHub release notes, between `<!-- cert-verify -->` markers: `certified @ai-ecoverse/mcpcat@<version> sha256=<sha> (…; pr-certified since v<prev>: …)`, or `verified …` when some pull request lacks a green cert-review. A re-run with the same bytes leaves the notes as they are. Notes that already name another sha for the version, or npm bytes that don't verify, are a supply-chain alert: nothing is written and an issue is filed. Checks that couldn't run read `cert-ci: INCOMPLETE` and write nothing.
-
-Silence never passes: every gate in the workflows prints a verdict line, and its caller requires that line, not just an exit code. These are `all-green: PASS|FAIL …`, the cert job's `cert: kernel <v> — N kernel tests passed`, shipped.mjs's `behaviour:`/`not behaviour:`, release verify's `verified …`, and the installer tests' `All installer tests passed.`. A gate that exits 0 without its line fails.
+Silence never passes: every gate in the workflows prints a verdict line, and its caller requires that line, not just an exit code. These are `all-green: PASS|FAIL …`, the cert job's `cert: kernel <v> — N kernel tests passed`, shipped.mjs's `behaviour:`/`not behaviour:`, and the installer tests' `All installer tests passed.`. A gate that exits 0 without its line fails.
 
 ## Quick start
 

package/dist/host/mcpcat.mjs

@@ -8421,10 +8421,11 @@ var KERNEL_REFUSAL = "nodeTransport refuses ";
 function firstLine(text) {
   return text.trim().split("\n")[0].trim().slice(0, 200);
 }
-async function authReason(res) {
+async function authReason(res, redact2) {
   const type = res.headers.get("content-type") ?? "";
-  if (!type.toLowerCase().startsWith("text/plain")) return void 0;
-  return firstLine(await res.text()) || void 0;
+  if (!type.toLowerCase().startsWith("text/plain")) return {};
+  const text = await res.text();
+  return { raw: firstLine(text), reason: firstLine(redact2(text)) || void 0 };
 }
 function selectSseFrame(body, targetId) {
   const text = new TextDecoder().decode(body);
@@ -8541,7 +8542,8 @@ async function createStatelessConnection(options) {
     signal: externalSignal,
     verbose,
     authProvider,
-    transportRefusals
+    transportRefusals,
+    redact: redact2 = (text) => text
   } = options;
   let nextId2 = 1;
   let negotiatedVersion;
@@ -8560,9 +8562,9 @@ async function createStatelessConnection(options) {
   }
   async function handleErrorStatus(res, method) {
     if (res.status === 401 || res.status === 403) {
-      const reason = await authReason(res);
-      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && reason?.startsWith(KERNEL_REFUSAL)) {
-        throw new TransportRefusalError(403, reason);
+      const { raw, reason } = await authReason(res, redact2);
+      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && raw?.startsWith(KERNEL_REFUSAL)) {
+        throw new TransportRefusalError(403, reason ?? "");
       }
       if (authProvider) throw new AuthRetryableError(res, reason);
       throw new McpAuthError(res.status, url, reason);
@@ -8575,7 +8577,7 @@ async function createStatelessConnection(options) {
     } catch {
     }
     if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
-    throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+    throw new StatelessHttpError(res.status, res.statusText, method, redact2(text).slice(0, 512));
   }
   async function doFetch(method, params, body) {
     const token = await authProvider?.token();
@@ -9103,7 +9105,8 @@ async function connect(platform2, options) {
       signal: options.signal,
       verbose: options.verbose,
       authProvider: options.authProvider,
-      transportRefusals: platform2.kind === "kernel"
+      transportRefusals: platform2.kind === "kernel",
+      redact: options.redact
     });
   } catch (err) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
@@ -12209,7 +12212,7 @@ function createProxyHandler(options) {
   let connecting = null;
   const scrub = secretMasker(options.hiddenHeaders, "***");
   async function doConnect() {
-    const c = await connect(options.platform, options.connectOpts);
+    const c = await connect(options.platform, { ...options.connectOpts, redact: scrub });
     cachedInfo = await c.info();
     return c;
   }
@@ -16137,6 +16140,7 @@ async function probeServer(_name, config, platform2) {
     } else {
       return void 0;
     }
+    opts.redact = (text) => redactSecrets(text, secrets);
     const conn = await connect(platform2, opts);
     try {
       await conn.info();
@@ -16730,7 +16734,8 @@ async function runClientVerb(platform2, version, parsed) {
       signal: sigintController.signal,
       verbose,
       authProvider,
-      roots
+      roots,
+      redact: redact2
     });
     activeConn = conn;
   } catch (err) {
@@ -17067,5 +17072,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.17.9", args);
+var code = await run(platform, "0.17.10", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -8042,10 +8042,11 @@ var KERNEL_REFUSAL = "nodeTransport refuses ";
 function firstLine(text) {
   return text.trim().split("\n")[0].trim().slice(0, 200);
 }
-async function authReason(res) {
+async function authReason(res, redact2) {
   const type = res.headers.get("content-type") ?? "";
-  if (!type.toLowerCase().startsWith("text/plain")) return void 0;
-  return firstLine(await res.text()) || void 0;
+  if (!type.toLowerCase().startsWith("text/plain")) return {};
+  const text = await res.text();
+  return { raw: firstLine(text), reason: firstLine(redact2(text)) || void 0 };
 }
 function selectSseFrame(body, targetId) {
   const text = new TextDecoder().decode(body);
@@ -8162,7 +8163,8 @@ async function createStatelessConnection(options) {
     signal: externalSignal,
     verbose,
     authProvider,
-    transportRefusals
+    transportRefusals,
+    redact: redact2 = (text) => text
   } = options;
   let nextId2 = 1;
   let negotiatedVersion;
@@ -8181,9 +8183,9 @@ async function createStatelessConnection(options) {
   }
   async function handleErrorStatus(res, method) {
     if (res.status === 401 || res.status === 403) {
-      const reason = await authReason(res);
-      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && reason?.startsWith(KERNEL_REFUSAL)) {
-        throw new TransportRefusalError(403, reason);
+      const { raw, reason } = await authReason(res, redact2);
+      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && raw?.startsWith(KERNEL_REFUSAL)) {
+        throw new TransportRefusalError(403, reason ?? "");
       }
       if (authProvider) throw new AuthRetryableError(res, reason);
       throw new McpAuthError(res.status, url, reason);
@@ -8196,7 +8198,7 @@ async function createStatelessConnection(options) {
     } catch {
     }
     if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
-    throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+    throw new StatelessHttpError(res.status, res.statusText, method, redact2(text).slice(0, 512));
   }
   async function doFetch(method, params, body) {
     const token = await authProvider?.token();
@@ -8724,7 +8726,8 @@ async function connect(platform2, options) {
       signal: options.signal,
       verbose: options.verbose,
       authProvider: options.authProvider,
-      transportRefusals: platform2.kind === "kernel"
+      transportRefusals: platform2.kind === "kernel",
+      redact: options.redact
     });
   } catch (err) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
@@ -11830,7 +11833,7 @@ function createProxyHandler(options) {
   let connecting = null;
   const scrub = secretMasker(options.hiddenHeaders, "***");
   async function doConnect() {
-    const c = await connect(options.platform, options.connectOpts);
+    const c = await connect(options.platform, { ...options.connectOpts, redact: scrub });
     cachedInfo = await c.info();
     return c;
   }
@@ -15758,6 +15761,7 @@ async function probeServer(_name, config, platform2) {
     } else {
       return void 0;
     }
+    opts.redact = (text) => redactSecrets(text, secrets);
     const conn = await connect(platform2, opts);
     try {
       await conn.info();
@@ -16351,7 +16355,8 @@ async function runClientVerb(platform2, version, parsed) {
       signal: sigintController.signal,
       verbose,
       authProvider,
-      roots
+      roots,
+      redact: redact2
     });
     activeConn = conn;
   } catch (err) {
@@ -16789,7 +16794,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.17.9", args);
+  return run(platform2, "0.17.10", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.17.9",
+  "version": "0.17.10",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",
@@ -61,9 +61,9 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-bios": "1.37.3",
+    "@ai-ecoverse/slicc-bios": "1.38.0",
     "@ai-ecoverse/slicc-kernel": "1.142.1",
-    "@ai-ecoverse/slicc-shared-web": "1.29.11",
+    "@ai-ecoverse/slicc-shared-web": "1.29.13",
     "@biomejs/biome": "2.5.15",
     "@earendil-works/pi-codemode": "1.2.0",
     "@earendil-works/pi-mcp": "1.2.0",