@argosvix/mcp-server 0.14.1-alpha.1 → 0.21.0-alpha.2

package/dist/tools.test.js

@@ -19,29 +19,57 @@ describe("MCP version source of truth", () => {
     });
 });
 describe("MCP tools metadata", () => {
-    it("exposes 21 tools (16 v1.5 + v1.5 closure: 4 safety/eval read + 1 eval write)", () => {
+    it("exposes 49 tools (47 prior + v1.6 axis 1: rename_project + delete_project)", () => {
         expect(tools.map((t) => t.name).sort()).toEqual([
             "acknowledge_alert",
+            "aggregate_calls",
+            "bulk_delete_calls",
+            "compare_eval_runs",
             "create_alert",
+            "create_annotation",
+            "create_eval_criterion",
+            "create_project",
+            "create_prompt",
+            "create_saved_view",
+            "delete_alert",
+            "delete_annotation",
+            "delete_eval_criterion",
+            "delete_project",
+            "delete_prompt",
+            "delete_saved_view",
+            "export_calls",
             "get_alert",
             "get_annotation",
             "get_cost_summary",
             "get_eval_criterion",
             "get_eval_run",
+            "get_llm_budget",
+            "get_percentiles",
             "get_prompt",
             "get_safety_assessment",
             "list_alert_events",
             "list_alerts",
             "list_annotations_by_label",
             "list_annotations_for_call",
+            "list_audit_log",
             "list_eval_criteria",
             "list_eval_runs",
+            "list_projects",
             "list_prompts",
             "list_safety_assessments",
+            "list_saved_views",
             "query_calls",
+            "raise_llm_budget",
+            "rename_project",
+            "rename_prompt",
             "run_eval",
             "silence_alert",
+            "test_webhook",
             "unsilence_alert",
+            "update_alert",
+            "update_annotation",
+            "update_eval_criterion",
+            "update_prompt",
         ]);
     });
     it("each tool has description + inputSchema", () => {
@@ -136,6 +164,28 @@ describe("dispatchTool", () => {
         const parsed = JSON.parse(res.content[0]?.text ?? "{}");
         expect(parsed.groups[0].provider).toBe("openai");
     });
+    it("export_calls uses POST /v1/query/export (regression for path/method drift)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ records: [] }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "export_calls",
+            args: { provider: "openai", limit: 1000 },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const fetchedUrl = String(fetchMock.mock.calls[0]?.[0]);
+        expect(fetchedUrl).toContain("/v1/query/export");
+        expect(fetchedUrl).not.toContain("/v1/export?");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("POST");
+        const body = JSON.parse(init.body);
+        expect(body.provider).toBe("openai");
+        expect(body.limit).toBe(1000);
+    });
     it("list_alerts uses /v1/alerts endpoint", async () => {
         const res = await dispatchTool({
             name: "list_alerts",
@@ -353,6 +403,452 @@ describe("dispatchTool", () => {
         expect(init.method).toBe("DELETE");
         expect(init.body).toBeUndefined();
     });
+    it("update_alert sends PATCH to /v1/alerts/:id with allowlisted body (= v1.6 #13-4)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: "alt-abc123", name: "renamed" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "update_alert",
+            args: {
+                alertId: "alt-abc123",
+                name: "renamed",
+                thresholdValue: 50,
+                enabled: false,
+                // alertType は schema にないため呼び出し側で混入させない
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/alerts/alt-abc123");
+        expect(url).not.toContain("/silence");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("PATCH");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({ name: "renamed", thresholdValue: 50, enabled: false });
+        // alertId は path に carry、 body には混入しない
+        expect(body.alertId).toBeUndefined();
+    });
+    it("update_alert rejects invalid alertId (= path injection 防御)", async () => {
+        const res = await dispatchTool({
+            name: "update_alert",
+            args: { alertId: "../../admin/internal", name: "x" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("alertId required");
+    });
+    it("delete_alert sends DELETE to /v1/alerts/:id without body (= v1.6 #13-4)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(null, { status: 204 })));
+        const res = await dispatchTool({
+            name: "delete_alert",
+            args: { alertId: "alt-doomed42" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const parsed = JSON.parse(res.content[0]?.text ?? "{}");
+        expect(parsed.ok).toBe(true);
+        expect(parsed.status).toBe(204);
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/alerts/alt-doomed42");
+        expect(url).not.toContain("/silence");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("DELETE");
+        expect(init.body).toBeUndefined();
+    });
+    it("delete_alert rejects invalid alertId (= path injection 防御)", async () => {
+        const res = await dispatchTool({
+            name: "delete_alert",
+            args: { alertId: "/etc/passwd" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("alertId required");
+    });
+    it("create_annotation POSTs allowlisted body to /v1/annotations (= v1.6 #13-3)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 42, callId: "call-xyz" }), {
+            status: 201,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "create_annotation",
+            args: {
+                callId: "call-xyz",
+                annotationText: "looks good",
+                label: "approved",
+                qualityScore: 5,
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/annotations");
+        expect(url).not.toContain("/v1/annotations/");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("POST");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({
+            callId: "call-xyz",
+            annotationText: "looks good",
+            label: "approved",
+            qualityScore: 5,
+        });
+    });
+    it("create_annotation rejects invalid callId (= path injection 防御)", async () => {
+        const res = await dispatchTool({
+            name: "create_annotation",
+            args: { callId: "../../admin", annotationText: "x" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("callId required");
+    });
+    it("update_annotation sends PATCH with allowlisted body (= v1.6 #13-3)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 7, label: "renamed" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "update_annotation",
+            args: {
+                annotationId: 7,
+                label: "renamed",
+                qualityScore: 4,
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/annotations/7");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("PATCH");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({ label: "renamed", qualityScore: 4 });
+        // annotationId は path に carry、 body には混入しない
+        expect(body.annotationId).toBeUndefined();
+    });
+    it("delete_annotation sends DELETE to /v1/annotations/:id without body (= v1.6 #13-3)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(null, { status: 204 })));
+        const res = await dispatchTool({
+            name: "delete_annotation",
+            args: { annotationId: 99 },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const parsed = JSON.parse(res.content[0]?.text ?? "{}");
+        expect(parsed.ok).toBe(true);
+        expect(parsed.status).toBe(204);
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/annotations/99");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("DELETE");
+        expect(init.body).toBeUndefined();
+    });
+    it("create_prompt POSTs allowlisted body to /v1/prompts (= v1.6 #13-1)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 42, name: "customer_support" }), {
+            status: 201,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "create_prompt",
+            args: {
+                name: "customer_support",
+                version: "v1",
+                template: "Hello {{user}}",
+                variables: { user: "world" },
+                labels: ["production"],
+                description: "primary cs prompt",
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/prompts");
+        expect(url).not.toContain("/v1/prompts/");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("POST");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({
+            name: "customer_support",
+            version: "v1",
+            template: "Hello {{user}}",
+            variables: { user: "world" },
+            labels: ["production"],
+            description: "primary cs prompt",
+        });
+    });
+    it("create_prompt rejects missing name/version/template (= v1.6 #13-1)", async () => {
+        const res = await dispatchTool({
+            name: "create_prompt",
+            args: { name: "x" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("name + version + template required");
+    });
+    it("update_prompt sends PATCH to /v1/prompts/:id with allowlisted body (= v1.6 #13-1)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 7, labels: ["production"] }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "update_prompt",
+            args: {
+                promptId: 7,
+                labels: ["production"],
+                description: "renamed",
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/prompts/7");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("PATCH");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({ labels: ["production"], description: "renamed" });
+        expect(body.promptId).toBeUndefined();
+    });
+    it("rename_prompt POSTs to /v1/prompts/:id/rename with name+version body (= v1.6 #13-1)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 7, name: "customer_support" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "rename_prompt",
+            args: { promptId: 7, name: "customer_support", version: "v2" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/prompts/7/rename");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("POST");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({ name: "customer_support", version: "v2" });
+    });
+    it("rename_prompt rejects missing name/version (= v1.6 #13-1)", async () => {
+        const res = await dispatchTool({
+            name: "rename_prompt",
+            args: { promptId: 7, name: "x" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("name + version required");
+    });
+    it("delete_prompt sends DELETE to /v1/prompts/:id without body (= v1.6 #13-1)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(null, { status: 204 })));
+        const res = await dispatchTool({
+            name: "delete_prompt",
+            args: { promptId: 99 },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const parsed = JSON.parse(res.content[0]?.text ?? "{}");
+        expect(parsed.ok).toBe(true);
+        expect(parsed.status).toBe(204);
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/prompts/99");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("DELETE");
+        expect(init.body).toBeUndefined();
+    });
+    it("create_eval_criterion POSTs allowlisted body to /v1/eval-criteria (= v1.6 #13-2)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 11, name: "helpfulness" }), {
+            status: 201,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "create_eval_criterion",
+            args: {
+                name: "helpfulness",
+                rubric: "Score how helpful the answer is to the user.",
+                scaleMin: 1,
+                scaleMax: 5,
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/eval-criteria");
+        expect(url).not.toContain("/v1/eval-criteria/");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("POST");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({
+            name: "helpfulness",
+            rubric: "Score how helpful the answer is to the user.",
+            scaleMin: 1,
+            scaleMax: 5,
+        });
+    });
+    it("create_eval_criterion rejects missing required fields (= v1.6 #13-2)", async () => {
+        const res = await dispatchTool({
+            name: "create_eval_criterion",
+            args: { name: "x" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("name + rubric + scaleMin + scaleMax required");
+    });
+    it("update_eval_criterion sends PATCH with full body to /v1/eval-criteria/:id (= v1.6 #13-2)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ id: 11, name: "renamed" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "update_eval_criterion",
+            args: {
+                criterionId: 11,
+                name: "renamed",
+                rubric: "Updated rubric narrative here.",
+                scaleMin: 1,
+                scaleMax: 10,
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/eval-criteria/11");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("PATCH");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({
+            name: "renamed",
+            rubric: "Updated rubric narrative here.",
+            scaleMin: 1,
+            scaleMax: 10,
+        });
+        expect(body.criterionId).toBeUndefined();
+    });
+    it("get_llm_budget hits /v1/account/llm-feature-budget GET (= v1.6 #13-7)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ budgetUsd: 5, spentUsd: 1.2, remainingUsd: 3.8 }), { status: 200, headers: { "content-type": "application/json" } })));
+        const res = await dispatchTool({
+            name: "get_llm_budget",
+            args: {},
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/account/llm-feature-budget");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method ?? "GET").toBe("GET");
+    });
+    it("raise_llm_budget PATCHes /v1/account/llm-feature-budget with budgetUsd (= v1.6 #13-7)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ ok: true, budgetUsd: 30, spentUsd: 0, remainingUsd: 30 }), { status: 200, headers: { "content-type": "application/json" } })));
+        const res = await dispatchTool({
+            name: "raise_llm_budget",
+            args: { budgetUsd: 30 },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/account/llm-feature-budget");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("PATCH");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({ budgetUsd: 30 });
+    });
+    it("raise_llm_budget rejects missing budgetUsd (= v1.6 #13-7)", async () => {
+        const res = await dispatchTool({
+            name: "raise_llm_budget",
+            args: {},
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("budgetUsd required");
+    });
+    it("test_webhook POSTs allowlisted body to /v1/alerts/test-webhook (= v1.6 #13-5)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ ok: true, delivered: true, message: "test webhook delivered" }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        })));
+        const res = await dispatchTool({
+            name: "test_webhook",
+            args: {
+                url: "https://example.com/hook",
+                secret: "shhh",
+                alertName: "test alert",
+            },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/alerts/test-webhook");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("POST");
+        const body = JSON.parse(init.body);
+        expect(body).toEqual({
+            url: "https://example.com/hook",
+            secret: "shhh",
+            alertName: "test alert",
+        });
+    });
+    it("test_webhook rejects missing url (= v1.6 #13-5)", async () => {
+        const res = await dispatchTool({
+            name: "test_webhook",
+            args: { secret: "shhh" },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBe(true);
+        expect(res.content[0]?.text).toContain("url required");
+    });
+    it("delete_eval_criterion sends DELETE to /v1/eval-criteria/:id without body (= v1.6 #13-2)", async () => {
+        vi.stubGlobal("fetch", vi.fn(async () => new Response(null, { status: 204 })));
+        const res = await dispatchTool({
+            name: "delete_eval_criterion",
+            args: { criterionId: 11 },
+            apiKey: "argosvix_live_test",
+            apiBase: "https://ingest.example.com",
+        });
+        expect(res.isError).toBeUndefined();
+        const parsed = JSON.parse(res.content[0]?.text ?? "{}");
+        expect(parsed.ok).toBe(true);
+        expect(parsed.status).toBe(204);
+        const fetchMock = global.fetch;
+        const url = String(fetchMock.mock.calls[0]?.[0]);
+        expect(url).toContain("/v1/eval-criteria/11");
+        const init = fetchMock.mock.calls[0]?.[1];
+        expect(init.method).toBe("DELETE");
+        expect(init.body).toBeUndefined();
+    });
     it("silence_alert rejects invalid alertId (= path injection 防御)", async () => {
         const res = await dispatchTool({
             name: "silence_alert",