@anchrd/intel-api 0.12.4 → 0.12.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,6 +1,7 @@
1
1
  import { ToolTestResult } from "@anchrd/intel-contract";
2
2
  import { Client } from "@modelcontextprotocol/sdk/client/index.js";
3
3
  import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
4
+ import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
4
5
  function responseWithLimit(response, maxBytes) {
5
6
  const length = Number(response.headers.get("content-length"));
6
7
  if (Number.isFinite(length) && length > maxBytes) {
@@ -28,7 +29,26 @@ function responseWithLimit(response, maxBytes) {
28
29
  }
29
30
  export function createRemoteTools(deps) {
30
31
  async function connected(url, accessToken, signal, maxBytes, work) {
31
- const client = new Client({ name: "intel-tools", version: "0.1.0" });
32
+ /**
33
+ * ⚠️ The SDK's DEFAULT validator is Ajv, and Ajv cannot run in a Worker.
34
+ *
35
+ * `Client.cacheToolMetadata` compiles a validator for every tool that carries an `outputSchema`,
36
+ * Ajv builds that with `new Function`, and `workerd` answers `EvalError: Code generation from
37
+ * strings disallowed for this context`. The throw takes the WHOLE `tools/list` with it, so a
38
+ * single such tool empties the catalog of every other server (#308).
39
+ *
40
+ * Nothing announces this. Tools without an `outputSchema` never reach the line, so a portal can
41
+ * work for months and break the moment somebody adds a server whose tools declare one — which
42
+ * is exactly how it was found: three servers fine, the fourth took the screen down. And no test
43
+ * can catch it either: `@cloudflare/vitest-pool-workers` replaces `globalThis.Function` with a
44
+ * proxy onto an unsafe-eval binding, so code generation WORKS in every test and fails in every
45
+ * deployment.
46
+ *
47
+ * This is #229 one layer down — there Ajv sat in Intel's own schema adapter, here it sits in a
48
+ * dependency. The SDK offers the way out itself: `CfWorkerJsonSchemaValidator` interprets the
49
+ * schema instead of compiling it, and it is the same `@cfworker/json-schema` #229 settled on.
50
+ */
51
+ const client = new Client({ name: "intel-tools", version: "0.1.0" }, { jsonSchemaValidator: new CfWorkerJsonSchemaValidator() });
32
52
  const transport = new StreamableHTTPClientTransport(new URL(url), {
33
53
  fetch: async (input, init) => responseWithLimit(await deps.fetch(input, {
34
54
  ...init,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@anchrd/intel-api",
3
- "version": "0.12.4",
3
+ "version": "0.12.5",
4
4
  "type": "module",
5
5
  "license": "UNLICENSED",
6
6
  "repository": {