@creeperhost/modlens-mcp 1.6.20 → 1.6.22

package/scripts/fixtures/mod-license-corpus.json

@@ -0,0 +1,154 @@
+[
+  {
+    "name": "ModMenu",
+    "version": "v6Xx3fbU",
+    "release": "11.0.4",
+    "hash": "a88e0d67c82b0434cbf56776c482587c275ed660f635d33f53ba485dfa30dcc3",
+    "license": "MIT",
+    "expected": "hosted_allowed",
+    "target": "com.terraformersmc.modmenu.ModMenu"
+  },
+  {
+    "name": "FerriteCore",
+    "version": "sOzRw3CG",
+    "release": "7.0.3-fabric",
+    "hash": "98c3ab1d5aab8f14b5d082d3f1a467727fd335f02d124555c94339761c4c18f2",
+    "license": "MIT",
+    "expected": "hosted_allowed",
+    "target": "malte0811.ferritecore.IPlatformHooks"
+  },
+  {
+    "name": "MouseTweaks",
+    "version": "9I21YYxf",
+    "release": "1.21-2.26.1-neoforge",
+    "hash": "68e6f4201c5de97b77929a7215c9552495696ca6a3bf3ae4eacc34e135f6cc8b",
+    "license": "BSD-3-Clause",
+    "expected": "hosted_allowed",
+    "target": "yalter.mousetweaks.Constants"
+  },
+  {
+    "name": "DynamicFPS",
+    "version": "LqevwKp5",
+    "release": "3.11.4",
+    "hash": "0929d2b9e164a08d25a7ba8a5f0750081b66dea9171cec52d2f0fdc792fc7e5e",
+    "license": "MIT",
+    "expected": "hosted_allowed",
+    "target": "architectury_inject_dynamicfps_common_96ad272d90fa4fcc8d67753a3449cf6d_48138490a95625983251b45ac7336d8a7e463234a1fad5dfdc4c144b1c5f439adynamicfps3114devjar.PlatformMethods"
+  },
+  {
+    "name": "Controlling",
+    "version": "FaNppCJJ",
+    "release": "19.0.5",
+    "hash": "cc525fb6b030d9e4d33176983f278919e17b33935e2ca568929bdfa98f2b44a0",
+    "license": "MIT",
+    "expected": "hosted_allowed",
+    "target": "com.blamejared.controlling.Controlling"
+  },
+  {
+    "name": "Clumps",
+    "version": "jo7lDoK4",
+    "release": "19.0.0.1",
+    "hash": "b524ccdace2ef8fd19f5b2074f7de1103ac5065c52553f064c00e098346c293e",
+    "license": "MIT",
+    "expected": "hosted_allowed",
+    "target": "com.blamejared.clumps.helper.IClumpedOrb"
+  },
+  {
+    "name": "AppleSkin",
+    "version": "uAKA6Laj",
+    "release": "3.0.9+mc1.21",
+    "hash": "38b48dd6231341c9f964ce6e42c57ec866c6cc8f72bec938390a59bafb3922df",
+    "license": "Unlicense",
+    "expected": "hosted_allowed",
+    "target": "squeek.appleskin.ModInfo"
+  },
+  {
+    "name": "Architectury",
+    "version": "1IiqEQGl",
+    "release": "13.0.11+neoforge",
+    "hash": "9cc92f2c09533fc5482c60f993bd891c655a0e32b637037cdcb7c2b23adedeeb",
+    "license": "LGPL-3.0-only",
+    "expected": "local_only",
+    "target": "architectury_inject_architectury_common_d9fb27da44a148dfa43566d20897d6de_f4ed98e062c0e85c5cc998c6fbbab16b146fa1f727cd0f469b44c896e896070earchitectury13011devjar.PlatformMethods"
+  },
+  {
+    "name": "ClothConfig",
+    "version": "izKINKFg",
+    "release": "15.0.140+neoforge",
+    "hash": "65e722e0d98431a07c45f8bdd8d529a217cc8c175fde1740248bd5c1b4f3c0d4",
+    "license": "LGPL-3.0-only",
+    "expected": "local_only",
+    "target": "architectury_inject_clothconfig_common_d551de04735c42148ec07a78c43007d1_c487a9cf12e7d5bea169da255b814f03602bdeb8b51cff67162252c24f285789clothconfig150140devjar.PlatformMethods"
+  },
+  {
+    "name": "ModernFix",
+    "version": "5HLHxQ2F",
+    "release": "5.27.24+mc1.21.1",
+    "hash": "e6e9446890f0feb3aab3f6e73ae18cb17575c370f232179fef7baa30e61538fe",
+    "license": "LGPL-3.0-only",
+    "expected": "local_only",
+    "target": "org.embeddedt.modernfix.ModernFix"
+  },
+  {
+    "name": "Spark",
+    "version": "v5qtqRQi",
+    "release": "1.10.124-neoforge-1.21.1",
+    "hash": "647e8a81afbe414dba1df4ba15fd06c5d32d4cb544e68828405e8e074c2e16db",
+    "license": "GPL-3.0-only",
+    "expected": "local_only",
+    "target": "me.lucko.spark.neoforge.NeoForgePlatformInfo"
+  },
+  {
+    "name": "Sodium",
+    "version": "uMOpc5uV",
+    "release": "mc1.21.1-0.8.13-neoforge",
+    "hash": "575d187b15328d7bddd8a9b1bee64333c22c14735f5780ec49eac0cd5503c08d",
+    "license": "LicenseRef-Polyform-Shield-1.0.0",
+    "expected": "local_only",
+    "target": "net.caffeinemc.mods.sodium.service.SodiumServiceModLocator"
+  },
+  {
+    "name": "Iris",
+    "version": "t3ruzodq",
+    "release": "1.8.12+1.21.1-neoforge",
+    "hash": "3e3f94d2d5cdcb8145c4385d521974aa2d8669b2cc212351f70cf06488182e83",
+    "license": "LGPL-3.0-only",
+    "expected": "local_only",
+    "target": "de.odysseus.ithaka.digraph.Digraph"
+  },
+  {
+    "name": "Lithium",
+    "version": "N08Z8wog",
+    "release": "mc1.21.1-0.15.4-fabric",
+    "hash": "92329d98c57f5a22091a0adb509fdb1d60113a5602c708b799b13134bad13baa",
+    "license": "LGPL-3.0-only",
+    "expected": "local_only",
+    "target": "net.caffeinemc.mods.lithium.api.inventory.LithiumCooldownReceivingInventory"
+  },
+  {
+    "name": "EntityCulling",
+    "version": "8w8FfUPs",
+    "release": "1.11.2",
+    "hash": "3983b981da4a0583c7e58184a8631a23e56cc3b81f4cb53491ca600382879b82",
+    "license": "LicenseRef-tr7zw-Protective-License",
+    "expected": "local_only",
+    "target": "com.logisticscraft.occlusionculling.DataProvider"
+  },
+  {
+    "name": "JourneyMap",
+    "version": "CtFE7hwT",
+    "release": "1.21.1-6.0.9+neoforge",
+    "hash": "9bd7734542233d5281750572f17a9258449e826650c081e9a67dc426262c2fde",
+    "license": "LicenseRef-All-Rights-Reserved",
+    "expected": "local_only",
+    "target": "earcut4j.Earcut"
+  },
+  {
+    "name": "FabricAPI",
+    "version": "Mys3P7lK",
+    "release": "0.116.17+1.21.1",
+    "hash": "79ac44b40780acbd884b34c50be1e39af682847e5f5cb3b1fddeeaa768dce800",
+    "license": "Apache-2.0",
+    "expected": "hosted_allowed"
+  }
+]

package/scripts/gradle/modlens-runtime.init.gradle

@@ -0,0 +1,17 @@
+// Opt-in launch only. Never instrument Gradle itself or every JavaExec task.
+gradle.projectsEvaluated {
+    def configFile = new File(gradle.rootProject.projectDir, '.modlens/runtime/launch.properties')
+    if (!configFile.isFile()) throw new GradleException('Call ModLens runtime.setup for this project first')
+    def config = new Properties()
+    configFile.withInputStream { config.load(it) }
+    def taskPath = config.getProperty('task')
+    if (!taskPath.startsWith(':')) taskPath = ':' + taskPath
+    def target = gradle.rootProject.tasks.findByPath(taskPath)
+    if (!(target instanceof JavaExec)) {
+        throw new GradleException("ModLens requires a JavaExec dev run task; ${taskPath} is ${target?.class?.name ?: 'missing'}. Use every returned vmOptions entry on the actual game launch instead.")
+    }
+    target.jvmArgs("-javaagent:${config.getProperty('agent')}=${config.getProperty('connection')}")
+    // Minecraft 26.3 client startup needs this even without the agent.
+    target.jvmArgs('-XX:StackShadowPages=32')
+    target.jvmArgs("-XX:ErrorFile=${new File(configFile.parentFile, 'hs_err_pid%p.log').absolutePath}")
+}

package/scripts/runtime-test-client.mjs

@@ -0,0 +1,36 @@
+// Test adapter: run the same fixture through separate CLI processes instead of
+// importing RuntimeHub. Each call reconnects to the persistent companion.
+import { writeFile } from "node:fs/promises";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+
+export function runtimeTestClient(root) {
+    const launcher = fileURLToPath(new URL("../dist/launcher.js", import.meta.url));
+    const env = { ...process.env, MODLENS_CACHE_ROOT: join(root, "helper-cache") };
+    const run = (args) =>
+        JSON.parse(
+            execFileSync(process.execPath, [launcher, "--runtime", ...args], {
+                env,
+                encoding: "utf8",
+                timeout: 45000,
+            }),
+        );
+    async function request(body) {
+        const file = join(root, `helper-${randomUUID()}.json`);
+        await writeFile(file, JSON.stringify(body));
+        return run(["--request-file", file]);
+    }
+    return {
+        setup: (projectDir, mode, gradleTask, minecraftHooks) =>
+            request({ action: "setup", projectDir, mode, gradleTask, minecraftHooks }),
+        list: () => request({ action: "sessions" }),
+        events: (afterCursor, waitMs, sessionId) =>
+            request({ action: "events", afterCursor, waitMs, sessionId }),
+        command: (sessionId, command) => request({ action: "command", sessionId, command }),
+        artifact: (sessionId, artifactName) => request({ action: "artifact", sessionId, artifactName }),
+        launch: (projectId, javaHome) => request({ action: "launch", projectId, javaHome }),
+        close: async () => run(["stop"]),
+    };
+}

package/scripts/test-hosted-oauth.mjs

@@ -0,0 +1,186 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { once } from 'node:events';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = await mkdtemp(join(tmpdir(), 'modlens-oauth-test-'));
+const entry = fileURLToPath(new URL('../dist/server.js', import.meta.url));
+const port = async () => {
+    const socket = createServer();
+    socket.listen(0, '127.0.0.1');
+    await once(socket, 'listening');
+    const value = socket.address().port;
+    await new Promise(resolve => socket.close(resolve));
+    return value;
+};
+const providerPort = await port();
+const mcpPort = await port();
+const issuer = `http://127.0.0.1:${providerPort}`;
+const resource = `http://127.0.0.1:${mcpPort}/mcp`;
+const profiles = new Map();
+let partner = true;
+let subject = 'customer:42';
+let serial = 0;
+const provider = createServer(async (req, res) => {
+    const url = new URL(req.url, issuer);
+    const write = (status, data) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+    if (url.pathname === '/.well-known/oauth-authorization-server') return write(200, {
+        issuer, authorization_endpoint: issuer + '/authorize', token_endpoint: issuer + '/token',
+        authorization_response_iss_parameter_supported: true,
+    });
+    if (url.pathname === '/authorize') {
+        const callback = new URL(url.searchParams.get('redirect_uri'));
+        callback.searchParams.set('code', 'fake-code');
+        callback.searchParams.set('state', url.searchParams.get('state'));
+        callback.searchParams.set('iss', issuer);
+        res.writeHead(302, { Location: callback.toString() }); res.end(); return;
+    }
+    if (url.pathname === '/token') {
+        let raw = '';
+        for await (const chunk of req) raw += chunk;
+        const data = new URLSearchParams(raw);
+        if (data.get('grant_type') === 'refresh_token' && !data.get('refresh_token')?.startsWith('upstream-refresh-'))
+            return write(400, { error: 'invalid_grant' });
+        if (data.get('grant_type') === 'authorization_code' && data.get('code') !== 'fake-code')
+            return write(400, { error: 'invalid_grant' });
+        const access = `upstream-${++serial}`;
+        profiles.set(access, { sub: subject, is_partner: partner });
+        return write(200, { access_token: access, refresh_token: `upstream-refresh-${serial}`, token_type: 'Bearer', expires_in: 300 });
+    }
+    if (url.pathname === '/profile') {
+        const profile = profiles.get(req.headers.authorization?.slice(7));
+        return profile ? write(200, { ...profile, is_partner: partner }) : write(401, { error: 'invalid_token' });
+    }
+    write(404, {});
+});
+provider.listen(providerPort, '127.0.0.1');
+await once(provider, 'listening');
+const env = { ...process.env, MCP_PORT: String(mcpPort), MCP_HOST: '127.0.0.1',
+    MODLENS_HOME: root, MODLENS_CACHE_ROOT: join(root, 'cache'), DATABASE_URL: `file:${join(root, 'oauth.db')}`,
+    MODLENS_AUTO_EMBED: '0', MODLENS_AUTO_GRAPH: '0', MODLENS_HOSTED_LIMITS: '1', MODLENS_HOSTED_AUTH: 'oauth',
+    MODLENS_HOSTED_PROXY_SECRET: '', MODLENS_HOSTED_MC_SOURCE: '0', MODLENS_OAUTH_PUBLIC_URL: resource,
+    MODLENS_OAUTH_ISSUER: issuer, MODLENS_OAUTH_CLIENT_ID: 'test-modlens', MODLENS_OAUTH_SCOPES: 'partner.read offline_access',
+    MODLENS_OAUTH_PROFILE_URL: issuer + '/profile', MODLENS_OAUTH_REQUIRED_FIELD: 'is_partner',
+    MODLENS_OAUTH_REQUIRED_VALUE: 'true', MODLENS_OAUTH_STORAGE_KEY: randomBytes(32).toString('base64') };
+let server;
+async function start() {
+    server = spawn(process.execPath, [entry], { cwd: root, env, stdio: ['ignore', 'ignore', 'pipe'], windowsHide: true });
+    let output = '';
+    server.stderr.on('data', chunk => { output += chunk; });
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`ModLens startup timed out: ${output}`)), 20000);
+        const ready = () => { if (output.includes('listening on')) { clearTimeout(timer); server.stderr.off('data', ready); resolve(); } };
+        server.stderr.on('data', ready);
+        server.once('error', reject);
+        server.once('exit', () => { clearTimeout(timer); reject(new Error(`ModLens exited: ${output}`)); });
+        ready();
+    });
+}
+async function stop() {
+    if (!server || server.exitCode !== null) return;
+    const exited = once(server, 'exit');
+    server.kill();
+    await exited;
+}
+const fetchManual = (url, init) => fetch(url, { ...init, redirect: 'manual' });
+const form = data => new URLSearchParams(data);
+const initialize = (access, extra = {}) => fetchManual(resource, { method: 'POST', headers: {
+    Authorization: `Bearer ${access}`, 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream', ...extra,
+}, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {
+    protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'oauth-test', version: '1' },
+} }) });
+let clientId;
+async function login() {
+    const verifier = randomBytes(32).toString('base64url');
+    const pkce = createHash('sha256').update(verifier).digest('base64url');
+    const callback = 'http://127.0.0.1:54321/callback';
+    const auth = new URL(`http://127.0.0.1:${mcpPort}/oauth/authorize`);
+    for (const [key, value] of Object.entries({ client_id: clientId, redirect_uri: callback, response_type: 'code',
+        code_challenge: pkce, code_challenge_method: 'S256', state: 'client-state', resource, scope: 'modlens' }))
+        auth.searchParams.set(key, value);
+    const upstream = await fetchManual(auth);
+    assert.equal(upstream.status, 302);
+    const back = await fetchManual(upstream.headers.get('location'));
+    assert.equal(back.status, 302);
+    const done = await fetchManual(back.headers.get('location'));
+    assert.equal(done.status, 200);
+    const approval = (await done.text()).match(/name="approval" value="([^"]+)"/)?.[1];
+    assert.ok(approval);
+    const approved = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/approve`, { method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: form({ approval, decision: 'allow' }) });
+    assert.equal(approved.status, 302);
+    const result = new URL(approved.headers.get('location'));
+    assert.equal(result.searchParams.get('state'), 'client-state');
+    assert.equal(result.searchParams.get('iss'), `http://127.0.0.1:${mcpPort}`);
+    const tokenBody = form({ grant_type: 'authorization_code', client_id: clientId,
+        code: result.searchParams.get('code'), redirect_uri: callback, code_verifier: verifier, resource });
+    const exchanged = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/token`, { method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: tokenBody });
+    assert.equal(exchanged.status, 200);
+    const tokens = await exchanged.json();
+    const replay = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/token`, { method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: tokenBody });
+    assert.equal(replay.status, 400, 'authorization code cannot be replayed');
+    return tokens;
+}
+try {
+    await start();
+    const absent = await fetchManual(resource);
+    assert.equal(absent.status, 401);
+    assert.match(absent.headers.get('www-authenticate'), /resource_metadata=/);
+    const metadata = await (await fetchManual(`http://127.0.0.1:${mcpPort}/.well-known/oauth-protected-resource/mcp`)).json();
+    assert.deepEqual(metadata.authorization_servers, [`http://127.0.0.1:${mcpPort}`]);
+    const registration = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/register`, { method: 'POST',
+        headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['http://127.0.0.1:54321/callback'] }) });
+    assert.equal(registration.status, 201);
+    clientId = (await registration.json()).client_id;
+    const tokens = await login();
+    assert.match(tokens.access_token, /^mla_/);
+    assert.match(tokens.refresh_token, /^mlr_/);
+    assert.equal((await initialize(tokens.access_token)).status, 200);
+    assert.equal((await initialize(tokens.access_token, { 'x-modlens-user-id': 'forged' })).status, 401);
+    await stop();
+    await start();
+    assert.equal((await initialize(tokens.access_token)).status, 200, 'grant survives restart');
+    const refresh = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/token`, { method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: form({ grant_type: 'refresh_token',
+            client_id: clientId, refresh_token: tokens.refresh_token, resource }) });
+    assert.equal(refresh.status, 200);
+    const rotated = await refresh.json();
+    const replay = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/token`, { method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: form({ grant_type: 'refresh_token',
+            client_id: clientId, refresh_token: tokens.refresh_token }) });
+    assert.equal(replay.status, 400);
+    const firstSession = await initialize(rotated.access_token);
+    assert.equal(firstSession.status, 200);
+    const sessionId = firstSession.headers.get('mcp-session-id');
+    assert.ok(sessionId);
+    subject = 'customer:99';
+    const otherAccount = await login();
+    assert.equal((await initialize(otherAccount.access_token, { 'mcp-session-id': sessionId })).status, 404,
+        'one account cannot reuse another account session');
+    profiles.delete(`upstream-${serial}`);
+    assert.equal((await initialize(otherAccount.access_token)).status, 401, 'revoked upstream access fails closed');
+    partner = false;
+    assert.equal((await initialize(rotated.access_token)).status, 403);
+    assert.equal((await initialize(rotated.access_token)).status, 401);
+    const denied = await fetchManual(`http://127.0.0.1:${mcpPort}/oauth/authorize?client_id=bad`);
+    assert.equal(denied.status, 400);
+    await stop();
+    delete env.MODLENS_OAUTH_REQUIRED_FIELD;
+    delete env.MODLENS_OAUTH_REQUIRED_VALUE;
+    await start();
+    const generalAccount = await login();
+    assert.equal((await initialize(generalAccount.access_token)).status, 200,
+        'self-hosted mode accepts a valid account without a claim rule');
+    console.log('Hosted OAuth discovery, registration, sign-in, persistence, refresh, replay, session, revocation, partner, gateway-header and self-hosted checks passed.');
+} finally {
+    await stop();
+    await new Promise(resolve => provider.close(resolve));
+    await rm(root, { recursive: true, force: true });
+}

package/scripts/test-hosted-policy.mjs

@@ -0,0 +1,182 @@
+// Real transports, synthetic source only: no Minecraft download or decompilation.
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { mkdtemp, mkdir, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createServer } from "node:net";
+import { once } from "node:events";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import Database from "better-sqlite3";
+
+const root = await mkdtemp(join(tmpdir(), "modlens-hosted-test-"));
+const entry = fileURLToPath(new URL("../dist/server.js", import.meta.url));
+const listener = createServer();
+listener.listen(0, "127.0.0.1");
+await once(listener, "listening");
+const port = listener.address().port;
+await new Promise(resolve => listener.close(resolve));
+const endpoint = new URL(`http://127.0.0.1:${port}/mcp`);
+const secret = randomBytes(32).toString("hex");
+const env = { ...process.env, MCP_PORT: String(port), MCP_HOST: "127.0.0.1", MODLENS_HOME: root,
+    MODLENS_CACHE_ROOT: join(root, "cache"), DATABASE_URL: `file:${join(root, "usage.db")}`,
+    MODLENS_HOSTED_LIMITS: "1", MODLENS_HOSTED_PROXY_SECRET: secret, MODLENS_HOSTED_SOURCE_LINES: "200",
+    MODLENS_HOSTED_MC_SOURCE: "1", MODLENS_HOSTED_MC_SOURCE_TEAMS: "partner",
+    MODLENS_HOSTED_DAILY_BYTES: "15000", MODLENS_HOSTED_PERIOD_BYTES: "100000",
+    MODLENS_HOSTED_DAILY_REQUESTS: "1000", MODLENS_HOSTED_MINUTE_REQUESTS: "120",
+    MODLENS_HOSTED_RESPONSE_BYTES: "131072", MODLENS_AUTO_EMBED: "0", MODLENS_AUTO_GRAPH: "0" };
+const source = Array.from({ length: 600 }, (_, i) => `// Synthetic fixture line ${i + 1}`).join("\n");
+const fixtureDir = join(env.MODLENS_CACHE_ROOT, "mc-decompiled-named", "1.21.1", "example");
+await mkdir(fixtureDir, { recursive: true });
+await writeFile(join(fixtureDir, "Fixture.java"), source);
+await writeFile(join(env.MODLENS_CACHE_ROOT, "mc-decompiled-named", "1.21.1", ".decompile.done"), "0");
+const headers = (user, team) => ({ "x-modlens-proxy-secret": secret, "x-modlens-user-id": user,
+    ...(team ? { "x-modlens-team-id": team } : {}) });
+let server, exited;
+const clients = [];
+async function start() {
+    let logs = "";
+    server = spawn(process.execPath, [entry], { cwd: root, env, stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
+    exited = once(server, "exit");
+    server.stderr.on("data", data => { logs += data; });
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`Startup timed out: ${logs}`)), 15000);
+        const ready = () => {
+            if (logs.includes("listening on")) { clearTimeout(timer); server.stderr.off("data", ready); resolve(); }
+        };
+        server.stderr.on("data", ready);
+        server.once("error", reject);
+        server.once("exit", () => { clearTimeout(timer); reject(new Error(`Server exited: ${logs}`)); });
+        ready();
+    });
+}
+async function connect(user, team) {
+    const client = new Client({ name: "hosted-policy-test", version: "1" });
+    clients.push(client);
+    const transport = new StreamableHTTPClientTransport(endpoint, { requestInit: { headers: headers(user, team) } });
+    await client.connect(transport);
+    return { client, transport };
+}
+const read = (client, startLine = 1) => client.callTool({ name: "mc_source", arguments: {
+    action: "get_source", version: "1.21.1", className: "example.Fixture", startLine, maxLines: 10000,
+} });
+let passed = false;
+try {
+    await start();
+    const unauthorized = await fetch(endpoint, { method: "POST", headers: { "x-modlens-user-id": "spoof" }, body: "{}" });
+    assert.equal(unauthorized.status, 401);
+    const publicUser = await connect("public-developer");
+    const publicTools = await publicUser.client.listTools();
+    const publicMc = publicTools.tools.find(t => t.name === "mc_source");
+    assert.ok(publicMc.inputSchema.properties.action.enum.includes("source_info"));
+    assert.ok(publicMc.inputSchema.properties.action.enum.includes("index_status"));
+    assert.ok(publicMc.inputSchema.properties.action.enum.includes("get_source"));
+    assert.ok(!publicMc.inputSchema.properties.action.enum.includes("bytecode"));
+    await publicUser.client.callTool({ name: "report_issue", arguments: { action: "help" } });
+    // Seed synthetic version metadata so preparation can index the cached fixture offline.
+    const fixtureDb = new Database(join(root, "usage.db"));
+    fixtureDb.prepare("INSERT INTO mc_versions (version_id, type, release_time) VALUES (?, ?, ?)")
+        .run("1.21.1", "release", Date.now());
+    const publicSource = await read(publicUser.client);
+    assert.ok(!publicSource.isError, JSON.stringify(publicSource));
+    assert.ok(!JSON.stringify(publicSource).includes("Synthetic fixture"));
+    assert.equal(JSON.parse(publicSource.content[0].text).status, "preparing");
+    let prepared;
+    for (let attempt = 0; attempt < 30; attempt++) {
+        await new Promise(resolve => setTimeout(resolve, 100));
+        prepared = JSON.parse((await read(publicUser.client)).content[0].text);
+        if (prepared.status === "ready") break;
+    }
+    assert.equal(prepared.status, "ready", JSON.stringify(prepared));
+    assert.equal(prepared.indexed, true);
+    for (let attempt = 0; attempt < 30; attempt++) {
+        if (fixtureDb.prepare("SELECT indexed FROM mc_versions WHERE version_id = ?").get("1.21.1")?.indexed) break;
+        await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    assert.equal(fixtureDb.prepare("SELECT indexed FROM mc_versions WHERE version_id = ?").get("1.21.1")?.indexed, 1,
+        "first hosted Minecraft request must index the complete cached version");
+    fixtureDb.close();
+    const fullStatus = await publicUser.client.callTool({ name: "mc_source", arguments: {
+        action: "index_status", version: "1.21.1",
+    } });
+    assert.deepEqual(JSON.parse(fullStatus.content[0].text), { version: "1.21.1", complete: true, status: "ready" });
+    const info = await publicUser.client.callTool({ name: "mc_source", arguments: {
+        action: "source_info", version: "1.21.1", className: "example.Fixture",
+    } });
+    assert.deepEqual(JSON.parse(info.content[0].text), { version: "1.21.1", className: "example/Fixture", cached: true, totalLines: 600 });
+    const missingInfo = await publicUser.client.callTool({ name: "mc_source", arguments: {
+        action: "source_info", version: "1.21.1", className: "example.Missing",
+    } });
+    assert.deepEqual(JSON.parse(missingInfo.content[0].text), { version: "1.21.1", className: "example/Missing", cached: false, totalLines: null });
+    const publicSearch = await publicUser.client.callTool({ name: "mc_source", arguments: {
+        action: "search_code", version: "1.21.1", query: "Synthetic fixture line 319",
+    } });
+    assert.ok(!publicSearch.isError, JSON.stringify(publicSearch));
+    assert.deepEqual(JSON.parse(publicSearch.content[0].text), [{ file: "example/Fixture.java", line: 319 }]);
+    const indexedSearch = await publicUser.client.callTool({ name: "mc_source", arguments: {
+        action: "search_indexed", version: "1.21.1", query: "fixture",
+    } });
+    assert.ok(!indexedSearch.isError, JSON.stringify(indexedSearch));
+    assert.deepEqual(JSON.parse(indexedSearch.content[0].text), [{ className: "example/Fixture" }]);
+    const { client, transport } = await connect("developer-a", "partner");
+    const listed = await client.listTools();
+    assert.ok(listed.tools.some(t => t.name === "report_issue"), "Hosted users must discover issue reporting");
+    const reporter = await connect("issue-reporter");
+    const preparedIssue = await reporter.client.callTool({ name: "report_issue", arguments: {
+        action: "prepare", title: "Hosted test fixture", summary: "Synthetic report; never submit.",
+    } });
+    assert.ok(!preparedIssue.isError, JSON.stringify(preparedIssue));
+    const issuePlan = JSON.parse(preparedIssue.content[0].text);
+    assert.equal(issuePlan.state, "draft_prepared");
+    assert.equal(issuePlan.executed, false);
+    assert.equal(issuePlan.repository.url, "https://github.com/CreeperHost/modlens-mcp");
+    const mc = listed.tools.find(t => t.name === "mc_source");
+    assert.ok(mc.inputSchema.properties.action.enum.includes("bytecode"));
+    for (const action of ["decompile", "get_paths", "index", "decompile_status"]) {
+        assert.ok(!mc.inputSchema.properties.action.enum.includes(action), action);
+    }
+    assert.ok(listed.tools.some(t => t.name === "mc_data"));
+    assert.ok(listed.tools.find(t => t.name === "mod_bytecode").inputSchema.properties.startLine);
+    const denied = await client.callTool({ name: "mc_source", arguments: { action: "get_paths", version: "1.21.1" } });
+    assert.ok(denied.isError);
+    const wrongOwner = await fetch(endpoint, { headers: { ...headers("developer-b"), "mcp-session-id": transport.sessionId, accept: "text/event-stream" } });
+    assert.equal(wrongOwner.status, 404);
+    const wrongTeam = await fetch(endpoint, { headers: { ...headers("developer-a"), "mcp-session-id": transport.sessionId, accept: "text/event-stream" } });
+    assert.equal(wrongTeam.status, 404);
+    const first = await read(client);
+    assert.ok(!first.isError, JSON.stringify(first));
+    assert.equal(first.content[0].text, source.split("\n").slice(0, 200).join("\n"));
+    const second = await read(client, 201);
+    assert.ok(!second.isError, JSON.stringify(second));
+    assert.equal(second.content[0].text, source.split("\n").slice(200, 400).join("\n"));
+    const exhausted = await read(client, 401);
+    assert.ok(exhausted.isError);
+    assert.ok(!JSON.stringify(exhausted).includes("Synthetic fixture"));
+    const reconnected = await connect("developer-a", "partner");
+    assert.ok((await read(reconnected.client)).isError, "reconnect must retain quota");
+    for (const c of clients.splice(0)) await c.close();
+    server.kill(); await exited;
+    await start();
+    const restarted = await connect("developer-a", "partner");
+    assert.ok((await read(restarted.client)).isError, "restart must retain quota");
+    const different = await connect("developer-b", "partner");
+    assert.ok(!(await read(different.client)).isError, "separate verified accounts have separate allowances");
+    const local = new Client({ name: "hosted-local-test", version: "1" });
+    clients.push(local);
+    await local.connect(new StdioClientTransport({ command: process.execPath, args: [entry], cwd: root,
+        env: { ...env, MCP_PORT: "" }, stderr: "pipe" }));
+    const localResult = await read(local);
+    assert.ok(!localResult.isError, JSON.stringify(localResult));
+    assert.equal(localResult.content[0].text, source, "local source access remains unrestricted");
+    passed = true;
+    console.log("PASS: public metadata-only access, team source access, authentication, account/session binding, source paging, cumulative limits, reconnect/restart persistence and unrestricted local access");
+} finally {
+    for (const client of clients) await client.close().catch(() => {});
+    if (server && server.exitCode === null) { server.kill(); await exited; }
+    if (passed) await rm(root, { recursive: true, force: true });
+    else console.error(`Fixture retained for debugging: ${root}`);
+}