@autobest-ui/agent 1.0.1 → 1.0.3

package/mcp/rag-mcp-bridge/index.test.js

@@ -1,56 +1,279 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { after, before, test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import {
+  MAX_IMAGE_BYTES,
+  MAX_REQUEST_BYTES,
+  buildDocuments,
+  expandMarkdownPaths,
+  serializeRequestBody
+} from './documents.js';
 
 const directory = path.dirname(fileURLToPath(import.meta.url));
+const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00]);
 
-test("initializes and exposes the RAG tools over stdio", async () => {
-  const client = new Client({ name: "rag-mcp-bridge-test", version: "1.0.0" });
+let apiServer;
+let client;
+let temporaryDirectory;
+const requests = [];
+
+async function readRequestBody(request) {
+  const chunks = [];
+  for await (const chunk of request) chunks.push(chunk);
+  return chunks.length > 0 ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : undefined;
+}
+
+async function callTool(name, args) {
+  return client.callTool({ name, arguments: args });
+}
+
+function toolText(result) {
+  return result.content.map(item => item.text ?? '').join('\n');
+}
+
+before(async () => {
+  temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), 'rag-mcp-bridge-'));
+  apiServer = createServer(async (request, response) => {
+    const url = new URL(request.url, 'http://localhost');
+    requests.push({
+      method: request.method,
+      path: url.pathname,
+      query: Object.fromEntries(url.searchParams),
+      body: await readRequestBody(request)
+    });
+    response.writeHead(200, { 'content-type': 'application/json' });
+    response.end(JSON.stringify({ ok: true, endpoint: url.pathname }));
+  });
+  await new Promise(resolve => apiServer.listen(0, '127.0.0.1', resolve));
+  const address = apiServer.address();
+  const apiBaseUrl = `http://127.0.0.1:${address.port}/api/knowledge`;
+
+  client = new Client({ name: 'rag-mcp-bridge-test', version: '1.0.0' });
   const transport = new StdioClientTransport({
     command: process.execPath,
-    args: [path.join(directory, "index.js")],
-    cwd: path.resolve(directory, "../.."),
-    env: {
-      RAG_API_BASE_URL: "http://127.0.0.1:3000/api/knowledge",
-    },
-    stderr: "pipe",
-  });
-
-  try {
-    await client.connect(transport);
-
-    assert.equal(client.getServerVersion()?.name, "rag-mcp-bridge");
-    assert.match(client.getInstructions() ?? "", /retrieve_knowledge/);
-
-    const { tools } = await client.listTools();
-    assert.deepEqual(
-      tools.map(({ name }) => name),
-      ["add_prd_file", "update_spec_file", "retrieve_knowledge"],
-    );
-    assert.equal(
-      tools.find(({ name }) => name === "retrieve_knowledge")?.annotations
-        ?.readOnlyHint,
-      true,
-    );
-  } finally {
-    await client.close();
-  }
-});
-
-test("fails to start when RAG_API_BASE_URL is not configured", () => {
+    args: [path.join(directory, 'index.js')],
+    cwd: path.resolve(directory, '../..'),
+    env: { RAG_API_BASE_URL: apiBaseUrl },
+    stderr: 'pipe'
+  });
+  await client.connect(transport);
+});
+
+after(async () => {
+  await client?.close();
+  await new Promise(resolve => apiServer?.close(resolve));
+  await rm(temporaryDirectory, { recursive: true, force: true });
+});
+
+test('initializes and preserves the existing MCP tool contract', async () => {
+  assert.equal(client.getServerVersion()?.name, 'rag-mcp-bridge');
+  assert.match(client.getInstructions() ?? '', /retrieve_knowledge/);
+  const { tools } = await client.listTools();
+  assert.deepEqual(
+    tools.map(({ name }) => name),
+    ['add_prd_file', 'update_spec_file', 'retrieve_knowledge']
+  );
+  assert.equal(tools.find(({ name }) => name === 'retrieve_knowledge')?.annotations?.readOnlyHint, true);
+});
+
+test('add_prd_file uploads one Unicode Markdown file and its encoded local image', async () => {
+  const root = path.join(temporaryDirectory, '单文件 根目录');
+  const docs = path.join(root, '页面 文档');
+  const attachments = path.join(root, '.attachments');
+  await Promise.all([mkdir(docs, { recursive: true }), mkdir(attachments, { recursive: true })]);
+  const markdownPath = path.join(docs, '首页 需求.md');
+  const imageReference = '../.attachments/%E7%A4%BA%E4%BE%8B%20%E5%9B%BE%E7%89%87.png';
+  const markdown = `# 首页\n\n![本地图片][local-shot]\n![远端](https://example.com/a.png)\n![内嵌](data:image/png;base64,AAAA)\n\n[local-shot]: ${imageReference}\n`;
+  await Promise.all([writeFile(markdownPath, markdown), writeFile(path.join(attachments, '示例 图片.png'), png)]);
+
+  const result = await callTool('add_prd_file', {
+    paths: markdownPath,
+    platform: 'app',
+    module: 'vehicle-selector',
+    page: 'home'
+  });
+  assert.notEqual(result.isError, true);
+  const request = requests.at(-1);
+  assert.equal(request.path, '/api/knowledge/add-prd');
+  assert.equal('paths' in request.body, false);
+  assert.equal(request.body.page, 'home');
+  assert.equal(request.body.documents.length, 1);
+  assert.deepEqual(request.body.documents[0], {
+    docKey: path.resolve(markdownPath),
+    fileName: '首页 需求.md',
+    markdown,
+    assets: [{ path: imageReference, mimeType: 'image/png', base64: png.toString('base64') }]
+  });
+});
+
+test('file arrays and recursive directories upload all documents, omit page, and preserve shared assets', async () => {
+  const root = path.join(temporaryDirectory, '批量');
+  const docs = path.join(root, 'docs');
+  const nested = path.join(docs, 'nested');
+  const attachments = path.join(root, '.attachments');
+  await Promise.all([mkdir(nested, { recursive: true }), mkdir(attachments, { recursive: true })]);
+  await writeFile(path.join(attachments, 'shared.png'), png);
+  const first = path.join(docs, 'PL.md');
+  const second = path.join(docs, 'PN.md');
+  const third = path.join(nested, 'PD.md');
+  await Promise.all([
+    writeFile(first, '![shared](../.attachments/shared.png)'),
+    writeFile(second, '![shared](../.attachments/shared.png)'),
+    writeFile(third, '# no local image')
+  ]);
+
+  await callTool('add_prd_file', { paths: [first, second], platform: 'app', page: 'pl' });
+  const arrayRequest = requests.at(-1);
+  assert.equal(arrayRequest.body.page, undefined);
+  assert.equal(arrayRequest.body.documents.length, 2);
+  assert.equal(arrayRequest.body.documents[0].assets[0].base64, png.toString('base64'));
+  assert.equal(arrayRequest.body.documents[1].assets[0].base64, png.toString('base64'));
+
+  await callTool('add_prd_file', { paths: docs, platform: 'app', module: 'vehicle-selector' });
+  const directoryRequest = requests.at(-1);
+  assert.deepEqual(
+    directoryRequest.body.documents.map(document => document.fileName),
+    ['PD.md', 'PL.md', 'PN.md']
+  );
+  assert.equal(directoryRequest.body.page, undefined);
+});
+
+test('update_spec_file uses documents mode and preserves iteration metadata', async () => {
+  const specPath = path.join(temporaryDirectory, '迭代 spec.md');
+  await writeFile(specPath, '# iteration');
+  await callTool('update_spec_file', {
+    paths: specPath,
+    sprintVersion: 12,
+    iterationTag: '2026-S12',
+    platform: 'california-web',
+    module: 'vehicle-selector',
+    page: 'pd'
+  });
+  const request = requests.at(-1);
+  assert.equal(request.path, '/api/knowledge/add-spec');
+  assert.equal('paths' in request.body, false);
+  assert.equal(request.body.sprintVersion, 12);
+  assert.equal(request.body.iterationTag, '2026-S12');
+  assert.equal(request.body.page, 'pd');
+  assert.equal(request.body.documents[0].markdown, '# iteration');
+});
+
+test('retrieve_knowledge remains a GET request with the existing query mapping', async () => {
+  await callTool('retrieve_knowledge', {
+    query: 'selector requirements',
+    platform: 'app',
+    module: 'vehicle-selector',
+    page: 'home',
+    enableStruct: false,
+    includeImages: false
+  });
+  const request = requests.at(-1);
+  assert.equal(request.method, 'GET');
+  assert.equal(request.path, '/api/knowledge/search');
+  assert.deepEqual(request.query, {
+    query: 'selector requirements',
+    platform: 'app',
+    module: 'vehicle-selector',
+    page: 'home',
+    enableStruct: 'false',
+    includeImages: 'false'
+  });
+});
+
+test('reports missing images with the Markdown file and referenced path', async () => {
+  const markdownPath = path.join(temporaryDirectory, '缺图.md');
+  await writeFile(markdownPath, '![missing](images/not-found.png)');
+  const result = await callTool('add_prd_file', { paths: markdownPath, platform: 'app' });
+  assert.equal(result.isError, true);
+  assert.match(toolText(result), /缺图\.md/);
+  assert.match(toolText(result), /images\/not-found\.png/);
+  assert.match(toolText(result), /不存在/);
+});
+
+test('rejects unsafe image inputs', async t => {
+  await t.test('unsupported extension', async () => {
+    const markdownPath = path.join(temporaryDirectory, '非法类型.md');
+    await writeFile(markdownPath, '![svg](image.svg)');
+    const result = await callTool('add_prd_file', { paths: markdownPath, platform: 'app' });
+    assert.equal(result.isError, true);
+    assert.match(toolText(result), /不受支持的图片类型/);
+  });
+
+  await t.test('MIME signature mismatch', async () => {
+    const markdownPath = path.join(temporaryDirectory, '伪装图片.md');
+    await Promise.all([
+      writeFile(markdownPath, '![fake](fake.png)'),
+      writeFile(path.join(temporaryDirectory, 'fake.png'), 'secret')
+    ]);
+    const result = await callTool('add_prd_file', { paths: markdownPath, platform: 'app' });
+    assert.equal(result.isError, true);
+    assert.match(toolText(result), /内容与扩展名不匹配/);
+  });
+
+  await t.test('single image size limit', async () => {
+    const markdownPath = path.join(temporaryDirectory, '超大图片.md');
+    const oversized = Buffer.alloc(MAX_IMAGE_BYTES + 1);
+    png.copy(oversized);
+    await Promise.all([
+      writeFile(markdownPath, '![large](large.png)'),
+      writeFile(path.join(temporaryDirectory, 'large.png'), oversized)
+    ]);
+    const result = await callTool('add_prd_file', { paths: markdownPath, platform: 'app' });
+    assert.equal(result.isError, true);
+    assert.match(toolText(result), /超过单文件限制/);
+  });
+
+  await t.test('path traversal outside approved attachment roots', async () => {
+    const docs = path.join(temporaryDirectory, 'traversal', 'docs');
+    await mkdir(docs, { recursive: true });
+    const markdownPath = path.join(docs, '越界.md');
+    await writeFile(markdownPath, '![outside](../secret.png)');
+    const result = await callTool('add_prd_file', { paths: markdownPath, platform: 'app' });
+    assert.equal(result.isError, true);
+    assert.match(toolText(result), /越界\.md/);
+    assert.match(toolText(result), /\.\.\/secret\.png/);
+    assert.match(toolText(result), /路径越界/);
+  });
+});
+
+test('enforces the total request size while packaging and serializing', async () => {
+  const markdownPath = path.join(temporaryDirectory, '超大文档.md');
+  await writeFile(markdownPath, 'x'.repeat(MAX_REQUEST_BYTES + 1));
+  await assert.rejects(() => buildDocuments([markdownPath]), /内容超过单次请求限制/);
+  assert.throws(
+    () => serializeRequestBody({ documents: [{ markdown: 'x'.repeat(MAX_REQUEST_BYTES) }] }),
+    /超过单次限制/
+  );
+});
+
+test('expands files, arrays, and recursive directories in stable order', async () => {
+  const root = path.join(temporaryDirectory, 'expand');
+  const nested = path.join(root, 'nested');
+  await mkdir(nested, { recursive: true });
+  const a = path.join(root, 'a.md');
+  const b = path.join(nested, 'b.md');
+  await Promise.all([writeFile(a, '# a'), writeFile(b, '# b'), writeFile(path.join(root, 'ignored.txt'), 'x')]);
+  assert.deepEqual(await expandMarkdownPaths(a), [a]);
+  assert.deepEqual(await expandMarkdownPaths([b, a]), [a, b]);
+  assert.deepEqual(await expandMarkdownPaths(root), [a, b]);
+  assert.equal((await buildDocuments([a]))[0].markdown, '# a');
+});
+
+test('fails to start when RAG_API_BASE_URL is not configured', () => {
   const environment = { ...process.env };
   delete environment.RAG_API_BASE_URL;
-
-  const result = spawnSync(process.execPath, [path.join(directory, "index.js")], {
-    cwd: path.resolve(directory, "../.."),
+  const result = spawnSync(process.execPath, [path.join(directory, 'index.js')], {
+    cwd: path.resolve(directory, '../..'),
     env: environment,
-    encoding: "utf8",
+    encoding: 'utf8'
   });
-
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /RAG_API_BASE_URL is required/);
 });

package/mcp/rag-mcp-bridge/package.json

@@ -10,12 +10,13 @@
   },
   "scripts": {
     "start": "node index.js",
-    "lint": "node --check index.js && node --check index.test.js",
+    "lint": "node --check index.js && node --check documents.js && node --check index.test.js",
     "test": "node --test index.test.js",
     "verify": "npm run lint && npm test"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
+    "mdast-util-from-markdown": "2.0.2",
     "zod": "4.4.3"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobest-ui/agent",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "private": false,
   "description": "Autobest Agent skills/plugins/mcp assets + sync cli",
   "files": [
@@ -39,6 +39,7 @@
     "@modelcontextprotocol/sdk": "1.30.0",
     "diff": "9.0.0",
     "fs-extra": "11.3.0",
+    "mdast-util-from-markdown": "2.0.2",
     "ws": "8.18.3",
     "zod": "4.4.3"
   },