@ai-ecoverse/mcpcat 0.17.9 → 0.17.11

package/README.md

@@ -28,9 +28,7 @@ mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Slicc
 
 Every change that alters what mcpcat ships is certified before it reaches `main`. A pull request that touches `src/`, the build, the dependencies or the release workflows gets mcpcat's cert-review on a pack of its head, and again in the merge queue on the exact tree that lands on `main`; a FAIL blocks the merge. Docs-, test- and CI-only changes skip it as "not behaviour". A draft pull request is not reviewed: its `cert-review` is red with `draft: not reviewed, mark it ready for review`, and marking it ready starts the review (converted_to_draft cancels a running one). Mark ready = reviewed, and merges on green; a pull request held for anything stays a draft. For a PR that needs the coordinator's security read, the order is: the coordinator reads the draft, it is marked ready, the cert runs, then the queue. Each merge to `main` is then released to npm as `latest` in one step by semantic-release, with provenance, so `npm install @ai-ecoverse/mcpcat` and the installer always get certified code. The verdict line is a comment on the pull request and the `cert-review` commit status. It reads `certified …`, `cert-ci: FAIL …` when the reviewer or a check in code found a defect (status `failure`), or `cert-ci: INCOMPLETE …` when the review couldn't decide: the review job didn't succeed or was skipped, no verdict could be read, or the artifact or the runner's own `gh` was missing (status `error`). A fork's change to shipped behaviour also reads INCOMPLETE, since it gets no review. INCOMPLETE never certifies; re-run the failed jobs. A run that ends without `record` posting its status (a crashed plan, record or verdict job) still posts one on the head: `error` with its INCOMPLETE line, or `failure` for a FAIL. So the required `cert-review` check never waits forever. The reviewer's verdict can add defects but never clear one found in code: `record` re-reads the suites' evidence (`stage.json`, `suites.json`), uploaded before the reviewer runs and bound by the artifact id and digest the review job output. A suite or security row that failed on the host or a pinned kernel, a changed test that fails on the head, an import in the kernel bundle or an unexplained rebuild difference is a FAIL. Missing suites, kernels or rows are INCOMPLETE. The NEGATIVE runs each changed test on the base's code: the subject's tests, helpers and fixtures with the base's `dist`, `scripts/` and `.github/workflows/`, all from the base sha, so a test of the cert tooling runs against main's tooling. The record names both shas. A changed test that also passes on the base is named in the line as `gaps: no-negative <file>`. Every artifact a later job reads (the tarball, the verdict, the suites' evidence) is downloaded by the artifact id its producer output, after `bind.mjs` checks the artifact's name, run and digest against that producer's outputs. Any other artifact from this attempt of the run under `mcpcat-tarball-`, `mcpcat-npm-tarball-` or `cert-review-` makes the line INCOMPLETE. An earlier attempt's leftovers, created before this attempt started, are never read.
 
-After each release, `cert-verify.yml` (on the Release run's success, or dispatched from `main` with a `version`) checks again that npm serves the SLSA subject built by `release.yml` on `main` from the tag, and that every pull request merged since the previous tag carries a green `cert-review` status on its head. Its hosted, write-only `notes` job then puts one line into the GitHub release notes, between `<!-- cert-verify -->` markers: `certified @ai-ecoverse/mcpcat@<version> sha256=<sha> (…; pr-certified since v<prev>: …)`, or `verified …` when some pull request lacks a green cert-review. A re-run with the same bytes leaves the notes as they are. Notes that already name another sha for the version, or npm bytes that don't verify, are a supply-chain alert: nothing is written and an issue is filed. Checks that couldn't run read `cert-ci: INCOMPLETE` and write nothing.
-
-Silence never passes: every gate in the workflows prints a verdict line, and its caller requires that line, not just an exit code. These are `all-green: PASS|FAIL …`, the cert job's `cert: kernel <v> — N kernel tests passed`, shipped.mjs's `behaviour:`/`not behaviour:`, release verify's `verified …`, and the installer tests' `All installer tests passed.`. A gate that exits 0 without its line fails.
+Silence never passes: every gate in the workflows prints a verdict line, and its caller requires that line, not just an exit code. These are `all-green: PASS|FAIL …`, the cert job's `cert: kernel <v> — N kernel tests passed`, shipped.mjs's `behaviour:`/`not behaviour:`, and the installer tests' `All installer tests passed.`. A gate that exits 0 without its line fails.
 
 ## Quick start
 

package/dist/host/mcpcat.mjs

@@ -8421,10 +8421,11 @@ var KERNEL_REFUSAL = "nodeTransport refuses ";
 function firstLine(text) {
   return text.trim().split("\n")[0].trim().slice(0, 200);
 }
-async function authReason(res) {
+async function authReason(res, redact2) {
   const type = res.headers.get("content-type") ?? "";
-  if (!type.toLowerCase().startsWith("text/plain")) return void 0;
-  return firstLine(await res.text()) || void 0;
+  if (!type.toLowerCase().startsWith("text/plain")) return {};
+  const text = await res.text();
+  return { raw: firstLine(text), reason: firstLine(redact2(text)) || void 0 };
 }
 function selectSseFrame(body, targetId) {
   const text = new TextDecoder().decode(body);
@@ -8541,7 +8542,8 @@ async function createStatelessConnection(options) {
     signal: externalSignal,
     verbose,
     authProvider,
-    transportRefusals
+    transportRefusals,
+    redact: redact2 = (text) => text
   } = options;
   let nextId2 = 1;
   let negotiatedVersion;
@@ -8560,9 +8562,9 @@ async function createStatelessConnection(options) {
   }
   async function handleErrorStatus(res, method) {
     if (res.status === 401 || res.status === 403) {
-      const reason = await authReason(res);
-      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && reason?.startsWith(KERNEL_REFUSAL)) {
-        throw new TransportRefusalError(403, reason);
+      const { raw, reason } = await authReason(res, redact2);
+      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && raw?.startsWith(KERNEL_REFUSAL)) {
+        throw new TransportRefusalError(403, reason ?? "");
       }
       if (authProvider) throw new AuthRetryableError(res, reason);
       throw new McpAuthError(res.status, url, reason);
@@ -8575,7 +8577,7 @@ async function createStatelessConnection(options) {
     } catch {
     }
     if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
-    throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+    throw new StatelessHttpError(res.status, res.statusText, method, redact2(text).slice(0, 512));
   }
   async function doFetch(method, params, body) {
     const token = await authProvider?.token();
@@ -9103,7 +9105,8 @@ async function connect(platform2, options) {
       signal: options.signal,
       verbose: options.verbose,
       authProvider: options.authProvider,
-      transportRefusals: platform2.kind === "kernel"
+      transportRefusals: platform2.kind === "kernel",
+      redact: options.redact
     });
   } catch (err) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
@@ -12209,7 +12212,7 @@ function createProxyHandler(options) {
   let connecting = null;
   const scrub = secretMasker(options.hiddenHeaders, "***");
   async function doConnect() {
-    const c = await connect(options.platform, options.connectOpts);
+    const c = await connect(options.platform, { ...options.connectOpts, redact: scrub });
     cachedInfo = await c.info();
     return c;
   }
@@ -13281,23 +13284,29 @@ function resolveProxyUrl(target, headers, version) {
   const url = target.startsWith("http") ? target : `https://${target}`;
   return { url, headers, version };
 }
+function unsetIn(header, value, env) {
+  const missing = missingPlaceholders(value, env);
+  if (missing.length === 0) return void 0;
+  return `unset variable ${missing.join(", ")} in header '${header}'`;
+}
+function hide(hidden, template, expanded, env) {
+  if (template) hidden.add(template);
+  if (expanded) hidden.add(expanded);
+  for (const p of placeholderValues(template, env)) hidden.add(p);
+}
 async function resolveProxyConfig(platform2, target, connectHeaders, hiddenValues, version) {
   const config = await MergedConfigSource.load(platform2);
   const entry = await config.get(target);
   if (!entry) return `unknown target '${target}'`;
   if ("url" in entry && entry.url) {
-    const expanded = expandHeaders(entry.headers, platform2.env, (msg) => {
-      platform2.write(2, `mcpcat serve --proxy: warning: ${msg}
-`).catch(() => {
-      });
-    });
-    const merged = { ...expanded, ...connectHeaders };
-    if (entry.headers) {
-      for (const v of Object.values(entry.headers)) {
-        hiddenValues.add(v);
-        for (const p of placeholderValues(v, platform2.env)) hiddenValues.add(p);
-      }
+    const expanded = {};
+    for (const [k, v] of Object.entries(entry.headers ?? {})) {
+      const missing = unsetIn(k, v, platform2.env);
+      if (missing) return missing;
+      expanded[k] = expandPlaceholders(v, platform2.env);
+      hide(hiddenValues, v, expanded[k], platform2.env);
     }
+    const merged = { ...expanded, ...connectHeaders };
     return { url: entry.url, headers: merged, version };
   }
   if ("command" in entry && entry.command) {
@@ -13316,12 +13325,12 @@ async function buildProxyConnectOpts(platform2, options, version) {
   const connectHeaders = {};
   const hiddenValues = /* @__PURE__ */ new Set();
   for (const [k, v] of options.proxyHeaders) {
-    const expanded = expandPlaceholdersStrict(v, platform2.env);
-    if (expanded === void 0) return { error: `unset variable in header '${k}'` };
+    const missing = unsetIn(k, v, platform2.env);
+    if (missing) return { error: missing };
+    const expanded = expandPlaceholders(v, platform2.env);
     const key = k.toLowerCase() === "authorization" ? "Authorization" : k;
     connectHeaders[key] = expanded;
-    hiddenValues.add(expanded);
-    for (const p of placeholderValues(v, platform2.env)) hiddenValues.add(p);
+    hide(hiddenValues, v, expanded, platform2.env);
   }
   const isUrl = target.startsWith("http://") || target.startsWith("https://") || target.includes(".");
   let connectOpts;
@@ -16137,6 +16146,7 @@ async function probeServer(_name, config, platform2) {
     } else {
       return void 0;
     }
+    opts.redact = (text) => redactSecrets(text, secrets);
     const conn = await connect(platform2, opts);
     try {
       await conn.info();
@@ -16730,7 +16740,8 @@ async function runClientVerb(platform2, version, parsed) {
       signal: sigintController.signal,
       verbose,
       authProvider,
-      roots
+      roots,
+      redact: redact2
     });
     activeConn = conn;
   } catch (err) {
@@ -17067,5 +17078,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.17.9", args);
+var code = await run(platform, "0.17.11", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -8042,10 +8042,11 @@ var KERNEL_REFUSAL = "nodeTransport refuses ";
 function firstLine(text) {
   return text.trim().split("\n")[0].trim().slice(0, 200);
 }
-async function authReason(res) {
+async function authReason(res, redact2) {
   const type = res.headers.get("content-type") ?? "";
-  if (!type.toLowerCase().startsWith("text/plain")) return void 0;
-  return firstLine(await res.text()) || void 0;
+  if (!type.toLowerCase().startsWith("text/plain")) return {};
+  const text = await res.text();
+  return { raw: firstLine(text), reason: firstLine(redact2(text)) || void 0 };
 }
 function selectSseFrame(body, targetId) {
   const text = new TextDecoder().decode(body);
@@ -8162,7 +8163,8 @@ async function createStatelessConnection(options) {
     signal: externalSignal,
     verbose,
     authProvider,
-    transportRefusals
+    transportRefusals,
+    redact: redact2 = (text) => text
   } = options;
   let nextId2 = 1;
   let negotiatedVersion;
@@ -8181,9 +8183,9 @@ async function createStatelessConnection(options) {
   }
   async function handleErrorStatus(res, method) {
     if (res.status === 401 || res.status === 403) {
-      const reason = await authReason(res);
-      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && reason?.startsWith(KERNEL_REFUSAL)) {
-        throw new TransportRefusalError(403, reason);
+      const { raw, reason } = await authReason(res, redact2);
+      if (transportRefusals && res.status === 403 && !res.headers.has("www-authenticate") && raw?.startsWith(KERNEL_REFUSAL)) {
+        throw new TransportRefusalError(403, reason ?? "");
       }
       if (authProvider) throw new AuthRetryableError(res, reason);
       throw new McpAuthError(res.status, url, reason);
@@ -8196,7 +8198,7 @@ async function createStatelessConnection(options) {
     } catch {
     }
     if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
-    throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+    throw new StatelessHttpError(res.status, res.statusText, method, redact2(text).slice(0, 512));
   }
   async function doFetch(method, params, body) {
     const token = await authProvider?.token();
@@ -8724,7 +8726,8 @@ async function connect(platform2, options) {
       signal: options.signal,
       verbose: options.verbose,
       authProvider: options.authProvider,
-      transportRefusals: platform2.kind === "kernel"
+      transportRefusals: platform2.kind === "kernel",
+      redact: options.redact
     });
   } catch (err) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
@@ -11830,7 +11833,7 @@ function createProxyHandler(options) {
   let connecting = null;
   const scrub = secretMasker(options.hiddenHeaders, "***");
   async function doConnect() {
-    const c = await connect(options.platform, options.connectOpts);
+    const c = await connect(options.platform, { ...options.connectOpts, redact: scrub });
     cachedInfo = await c.info();
     return c;
   }
@@ -12902,23 +12905,29 @@ function resolveProxyUrl(target, headers, version) {
   const url = target.startsWith("http") ? target : `https://${target}`;
   return { url, headers, version };
 }
+function unsetIn(header, value, env2) {
+  const missing = missingPlaceholders(value, env2);
+  if (missing.length === 0) return void 0;
+  return `unset variable ${missing.join(", ")} in header '${header}'`;
+}
+function hide(hidden, template, expanded, env2) {
+  if (template) hidden.add(template);
+  if (expanded) hidden.add(expanded);
+  for (const p of placeholderValues(template, env2)) hidden.add(p);
+}
 async function resolveProxyConfig(platform2, target, connectHeaders, hiddenValues, version) {
   const config = await MergedConfigSource.load(platform2);
   const entry = await config.get(target);
   if (!entry) return `unknown target '${target}'`;
   if ("url" in entry && entry.url) {
-    const expanded = expandHeaders(entry.headers, platform2.env, (msg) => {
-      platform2.write(2, `mcpcat serve --proxy: warning: ${msg}
-`).catch(() => {
-      });
-    });
-    const merged = { ...expanded, ...connectHeaders };
-    if (entry.headers) {
-      for (const v of Object.values(entry.headers)) {
-        hiddenValues.add(v);
-        for (const p of placeholderValues(v, platform2.env)) hiddenValues.add(p);
-      }
+    const expanded = {};
+    for (const [k, v] of Object.entries(entry.headers ?? {})) {
+      const missing = unsetIn(k, v, platform2.env);
+      if (missing) return missing;
+      expanded[k] = expandPlaceholders(v, platform2.env);
+      hide(hiddenValues, v, expanded[k], platform2.env);
     }
+    const merged = { ...expanded, ...connectHeaders };
     return { url: entry.url, headers: merged, version };
   }
   if ("command" in entry && entry.command) {
@@ -12937,12 +12946,12 @@ async function buildProxyConnectOpts(platform2, options, version) {
   const connectHeaders = {};
   const hiddenValues = /* @__PURE__ */ new Set();
   for (const [k, v] of options.proxyHeaders) {
-    const expanded = expandPlaceholdersStrict(v, platform2.env);
-    if (expanded === void 0) return { error: `unset variable in header '${k}'` };
+    const missing = unsetIn(k, v, platform2.env);
+    if (missing) return { error: missing };
+    const expanded = expandPlaceholders(v, platform2.env);
     const key = k.toLowerCase() === "authorization" ? "Authorization" : k;
     connectHeaders[key] = expanded;
-    hiddenValues.add(expanded);
-    for (const p of placeholderValues(v, platform2.env)) hiddenValues.add(p);
+    hide(hiddenValues, v, expanded, platform2.env);
   }
   const isUrl = target.startsWith("http://") || target.startsWith("https://") || target.includes(".");
   let connectOpts;
@@ -15758,6 +15767,7 @@ async function probeServer(_name, config, platform2) {
     } else {
       return void 0;
     }
+    opts.redact = (text) => redactSecrets(text, secrets);
     const conn = await connect(platform2, opts);
     try {
       await conn.info();
@@ -16351,7 +16361,8 @@ async function runClientVerb(platform2, version, parsed) {
       signal: sigintController.signal,
       verbose,
       authProvider,
-      roots
+      roots,
+      redact: redact2
     });
     activeConn = conn;
   } catch (err) {
@@ -16789,7 +16800,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.17.9", args);
+  return run(platform2, "0.17.11", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.17.9",
+  "version": "0.17.11",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",
@@ -61,9 +61,9 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-bios": "1.37.3",
+    "@ai-ecoverse/slicc-bios": "1.38.0",
     "@ai-ecoverse/slicc-kernel": "1.142.1",
-    "@ai-ecoverse/slicc-shared-web": "1.29.11",
+    "@ai-ecoverse/slicc-shared-web": "1.29.16",
     "@biomejs/biome": "2.5.15",
     "@earendil-works/pi-codemode": "1.2.0",
     "@earendil-works/pi-mcp": "1.2.0",