@cursor/july 0.1.20 → 0.1.21

package/src/internal/mcp-host.test.ts

@@ -0,0 +1,298 @@
+import { createServer, type IncomingMessage, type Server } from "node:http";
+import { fileURLToPath } from "node:url";
+import { afterEach, describe, expect, it } from "vitest";
+import { isStaleMcpSessionError, McpHost } from "./mcp-host.js";
+
+const unitsServer = fileURLToPath(
+  new URL("../../examples/weather-agent/mcp/units-server.ts", import.meta.url)
+);
+
+describe("isStaleMcpSessionError", () => {
+  it("detects anytool session_terminated payloads and HTTP 404 codes", () => {
+    expect(
+      isStaleMcpSessionError(
+        new Error(
+          'Streamable HTTP error: Error POSTing to endpoint: {"error":"session_terminated"}'
+        )
+      )
+    ).toBe(true);
+
+    const http404 = new Error(
+      "Streamable HTTP error: Error POSTing to endpoint: gone"
+    );
+    (http404 as { code?: number }).code = 404;
+    expect(isStaleMcpSessionError(http404)).toBe(true);
+
+    expect(isStaleMcpSessionError(new Error("unauthorized"))).toBe(false);
+    expect(isStaleMcpSessionError("session_terminated")).toBe(false);
+  });
+});
+
+describe("McpHost", () => {
+  const servers: Server[] = [];
+  afterEach(async () => {
+    await Promise.all(
+      servers.splice(0).map(
+        (server) =>
+          new Promise<void>((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+          })
+      )
+    );
+  });
+
+  it("lists and calls tools on a stdio connection", async () => {
+    const host = new McpHost([
+      {
+        name: "units",
+        transport: {
+          type: "stdio",
+          command: "npx",
+          args: ["-y", "tsx", unitsServer],
+        },
+      },
+    ]);
+    try {
+      expect(host.names()).toEqual(["units"]);
+      const tools = await host.listTools("units");
+      expect(tools.map((tool) => tool.name).sort()).toEqual([
+        "celsius_to_fahrenheit",
+        "fahrenheit_to_celsius",
+      ]);
+
+      const result = await host.callTool("units", "celsius_to_fahrenheit", {
+        value: 0,
+      });
+      expect(result.isError).toBeFalsy();
+      const text = result.content.find(
+        (part): part is { type: "text"; text: string } => part.type === "text"
+      )?.text;
+      expect(text).toBeDefined();
+      expect(JSON.parse(text as string)).toEqual({
+        celsius: 0,
+        fahrenheit: 32,
+      });
+    } finally {
+      await host.close();
+    }
+  }, 30_000);
+
+  it("rejects unknown MCP connection names", async () => {
+    const host = new McpHost([]);
+    await expect(host.callTool("missing", "noop", {})).rejects.toThrow(
+      /Unknown MCP connection "missing"/
+    );
+    await host.close();
+  });
+
+  it("reconnects after the remote Streamable HTTP session is terminated", async () => {
+    const mock = await startTerminatingMcpMock();
+    servers.push(mock.server);
+
+    const host = new McpHost([
+      {
+        name: "anytool",
+        transport: {
+          type: "http",
+          url: mock.url,
+        },
+      },
+    ]);
+    try {
+      const first = await host.callTool("anytool", "ping", {});
+      expect(first.isError).toBeFalsy();
+      expect(mock.initializeCount).toBe(1);
+
+      mock.terminateAllSessions();
+
+      const second = await host.callTool("anytool", "ping", {});
+      expect(second.isError).toBeFalsy();
+      expect(mock.initializeCount).toBe(2);
+    } finally {
+      await host.close();
+    }
+  }, 30_000);
+});
+
+async function startTerminatingMcpMock(): Promise<{
+  server: Server;
+  url: string;
+  initializeCount: number;
+  terminateAllSessions: () => void;
+}> {
+  const sessions = new Set<string>();
+  const state = { initializeCount: 0 };
+
+  const server = createServer((req, res) => {
+    void handleMcpRequest(req, res, sessions, state);
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    throw new Error("expected TCP listen address");
+  }
+
+  return {
+    server,
+    url: `http://127.0.0.1:${address.port}/mcp`,
+    get initializeCount() {
+      return state.initializeCount;
+    },
+    terminateAllSessions() {
+      sessions.clear();
+    },
+  };
+}
+
+async function handleMcpRequest(
+  req: IncomingMessage,
+  res: import("node:http").ServerResponse,
+  sessions: Set<string>,
+  state: { initializeCount: number }
+): Promise<void> {
+  if (req.method === "GET") {
+    // Optional SSE stream; idle keep-alive is enough for the SDK.
+    const sessionId = headerValue(req.headers["mcp-session-id"]);
+    if (sessionId === undefined || !sessions.has(sessionId)) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "session_terminated" }));
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "mcp-session-id": sessionId,
+    });
+    res.write(": connected\n\n");
+    return;
+  }
+
+  if (req.method === "DELETE") {
+    const sessionId = headerValue(req.headers["mcp-session-id"]);
+    if (sessionId !== undefined) {
+      sessions.delete(sessionId);
+    }
+    res.writeHead(200).end();
+    return;
+  }
+
+  if (req.method !== "POST") {
+    res.writeHead(405).end();
+    return;
+  }
+
+  const body = await readJsonBody(req);
+  const sessionId = headerValue(req.headers["mcp-session-id"]);
+  const method =
+    typeof body === "object" &&
+    body !== null &&
+    "method" in body &&
+    typeof body.method === "string"
+      ? body.method
+      : undefined;
+  const id =
+    typeof body === "object" && body !== null && "id" in body
+      ? body.id
+      : undefined;
+
+  if (method === "initialize") {
+    state.initializeCount += 1;
+    const nextSessionId = `session-${state.initializeCount}`;
+    sessions.add(nextSessionId);
+    writeSseJson(res, nextSessionId, {
+      jsonrpc: "2.0",
+      id,
+      result: {
+        protocolVersion: "2025-03-26",
+        capabilities: { tools: {} },
+        serverInfo: { name: "mock-anytool", version: "0.0.0" },
+      },
+    });
+    return;
+  }
+
+  if (sessionId === undefined || !sessions.has(sessionId)) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "session_terminated" }));
+    return;
+  }
+
+  if (method === undefined || id === undefined) {
+    // notifications/initialized and similar
+    res.writeHead(202).end();
+    return;
+  }
+
+  if (method === "tools/list") {
+    writeSseJson(res, sessionId, {
+      jsonrpc: "2.0",
+      id,
+      result: {
+        tools: [
+          {
+            name: "ping",
+            description: "ping",
+            inputSchema: { type: "object", properties: {} },
+          },
+        ],
+      },
+    });
+    return;
+  }
+
+  if (method === "tools/call") {
+    writeSseJson(res, sessionId, {
+      jsonrpc: "2.0",
+      id,
+      result: {
+        content: [{ type: "text", text: "pong" }],
+      },
+    });
+    return;
+  }
+
+  writeSseJson(res, sessionId, {
+    jsonrpc: "2.0",
+    id,
+    error: { code: -32601, message: `Method not found: ${method}` },
+  });
+}
+
+function writeSseJson(
+  res: import("node:http").ServerResponse,
+  sessionId: string,
+  payload: unknown
+): void {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    "mcp-session-id": sessionId,
+  });
+  res.end(`event: message\ndata: ${JSON.stringify(payload)}\n\n`);
+}
+
+function headerValue(value: string | string[] | undefined): string | undefined {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value) && value.length > 0) {
+    return value[0];
+  }
+  return undefined;
+}
+
+async function readJsonBody(req: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  if (chunks.length === 0) {
+    return undefined;
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8")) as unknown;
+}

package/src/internal/mcp-oauth.test.ts

@@ -0,0 +1,148 @@
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+  createHostMcpOAuthProvider,
+  FileMcpOAuthStore,
+  HostMcpOAuthProvider,
+  mcpOauthSecretNames,
+  normalizeMcpResourceUrl,
+  openBrowser,
+  tokensFromEnv,
+} from "./mcp-oauth.js";
+
+const ANYTOOL_URL = "https://anytool.example/mcp";
+
+describe("FileMcpOAuthStore", () => {
+  it("persists tokens and client info bound to resource URL", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "agentkit-mcp-oauth-"));
+    const path = join(dir, "mcp-auth.json");
+    const store = new FileMcpOAuthStore(path);
+
+    await store.saveTokens("anytool", ANYTOOL_URL, {
+      access_token: "access-1",
+      refresh_token: "refresh-1",
+      token_type: "Bearer",
+    });
+    await store.saveClientInformation("anytool", ANYTOOL_URL, {
+      client_id: "client-1",
+      redirect_uris: ["http://localhost:8787/callback"],
+    });
+
+    const reloaded = new FileMcpOAuthStore(path);
+    expect(await reloaded.loadTokens("anytool", ANYTOOL_URL)).toMatchObject({
+      access_token: "access-1",
+      refresh_token: "refresh-1",
+    });
+    expect(
+      await reloaded.loadClientInformation("anytool", ANYTOOL_URL)
+    ).toMatchObject({
+      client_id: "client-1",
+    });
+
+    const raw = JSON.parse(await readFile(path, "utf8")) as {
+      anytool: { resourceUrl: string; tokens: { refresh_token: string } };
+    };
+    expect(raw.anytool.resourceUrl).toBe(normalizeMcpResourceUrl(ANYTOOL_URL));
+    expect(raw.anytool.tokens.refresh_token).toBe("refresh-1");
+  });
+
+  it("ignores tokens when connection URL changes", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "agentkit-mcp-oauth-"));
+    const store = new FileMcpOAuthStore(join(dir, "mcp-auth.json"));
+    await store.saveTokens("anytool", ANYTOOL_URL, {
+      access_token: "access-1",
+      token_type: "Bearer",
+    });
+    expect(
+      await store.loadTokens("anytool", "https://evil.example/mcp")
+    ).toBeUndefined();
+    expect(await store.loadTokens("anytool", ANYTOOL_URL)).toMatchObject({
+      access_token: "access-1",
+    });
+  });
+
+  it("ignores legacy entries without resourceUrl", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "agentkit-mcp-oauth-"));
+    const path = join(dir, "mcp-auth.json");
+    await writeFile(
+      path,
+      JSON.stringify({
+        anytool: {
+          tokens: { access_token: "legacy", token_type: "Bearer" },
+        },
+      })
+    );
+    const store = new FileMcpOAuthStore(path);
+    expect(await store.loadTokens("anytool", ANYTOOL_URL)).toBeUndefined();
+  });
+});
+
+describe("HostMcpOAuthProvider", () => {
+  it("writes token updates back through the store", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "agentkit-mcp-oauth-"));
+    const store = new FileMcpOAuthStore(join(dir, "mcp-auth.json"));
+    const provider = await createHostMcpOAuthProvider({
+      identifier: "anytool",
+      resourceUrl: ANYTOOL_URL,
+      store,
+    });
+
+    await provider.saveTokens({
+      access_token: "access-2",
+      refresh_token: "refresh-2",
+      token_type: "Bearer",
+    });
+    expect(provider.tokens()?.refresh_token).toBe("refresh-2");
+    expect(
+      (await store.loadTokens("anytool", ANYTOOL_URL))?.refresh_token
+    ).toBe("refresh-2");
+  });
+
+  it("records redirect URLs for the login CLI", () => {
+    const redirects: string[] = [];
+    const provider = new HostMcpOAuthProvider({
+      identifier: "anytool",
+      resourceUrl: ANYTOOL_URL,
+      store: new FileMcpOAuthStore(join(tmpdir(), "unused.json")),
+      onRedirect: (url) => redirects.push(url.toString()),
+    });
+    provider.redirectToAuthorization(
+      new URL("https://anytool.example/oauth/authorize?x=1")
+    );
+    expect(provider.lastRedirectUrl?.toString()).toContain(
+      "anytool.example/oauth/authorize"
+    );
+    expect(redirects).toHaveLength(1);
+  });
+});
+
+describe("openBrowser", () => {
+  it("refuses non-http(s) URLs", () => {
+    expect(() => openBrowser("file:///etc/passwd")).toThrow(/non-http/);
+  });
+});
+
+describe("mcp oauth deployment secrets", () => {
+  it("names secrets from the connection id", () => {
+    expect(mcpOauthSecretNames("anytool")).toEqual({
+      accessToken: "MCP_OAUTH_ANYTOOL_ACCESS_TOKEN",
+      refreshToken: "MCP_OAUTH_ANYTOOL_REFRESH_TOKEN",
+      clientId: "MCP_OAUTH_ANYTOOL_CLIENT_ID",
+    });
+  });
+
+  it("reads bearer tokens from env when local file is empty", () => {
+    const names = mcpOauthSecretNames("anytool");
+    expect(
+      tokensFromEnv("anytool", {
+        [names.accessToken]: "access-env",
+        [names.refreshToken]: "refresh-env",
+      })
+    ).toMatchObject({
+      access_token: "access-env",
+      refresh_token: "refresh-env",
+    });
+  });
+});

package/src/internal/net.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { isLoopbackHostname } from "./net.js";
+
+describe("isLoopbackHostname", () => {
+  it("accepts localhost and loopback literals", () => {
+    expect(isLoopbackHostname("localhost")).toBe(true);
+    expect(isLoopbackHostname("127.0.0.1")).toBe(true);
+    expect(isLoopbackHostname("::1")).toBe(true);
+  });
+
+  it("rejects remote hostnames used in DNS rebinding", () => {
+    expect(isLoopbackHostname("attacker.example")).toBe(false);
+    expect(isLoopbackHostname("localhost.evil.example")).toBe(false);
+    expect(isLoopbackHostname("127.0.0.1.nip.io")).toBe(false);
+    expect(isLoopbackHostname("127.0.0.1.attacker.example")).toBe(false);
+  });
+});

package/src/internal/peer-connections.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, it } from "vitest";
+import { httpChannel } from "../channels.js";
+import type { AgentProject, ConnectionTransport } from "../types.js";
+import {
+  collectPeerConnections,
+  resolvePeerConnections,
+} from "./peer-connections.js";
+
+function makeProject(
+  name: string,
+  connections: Array<{ name: string; transport: ConnectionTransport }> = []
+): AgentProject {
+  return {
+    rootDir: `/tmp/${name}`,
+    agentDir: `/tmp/${name}/agent`,
+    name,
+    agent: {
+      name,
+      runtime: "local",
+      tools: [],
+      skills: [],
+      connections,
+      subagents: [],
+      seedFiles: [],
+    },
+    httpChannel: httpChannel(),
+    channels: [],
+    schedules: [],
+    hooks: [],
+    abs: [],
+    diagnostics: [],
+  };
+}
+
+describe("collectPeerConnections", () => {
+  it("groups validated refs by the referencing mount slug", () => {
+    const mounts = [
+      {
+        slug: "concierge",
+        project: makeProject("concierge", [
+          { name: "weather", transport: { agent: "weather-agent" } },
+          { name: "linear", transport: { url: "https://mcp.linear.app/mcp" } },
+        ]),
+      },
+      { slug: "weather-agent", project: makeProject("weather-agent") },
+    ];
+    const refs = collectPeerConnections(mounts);
+    expect([...refs.keys()]).toEqual(["concierge"]);
+    expect(refs.get("concierge")).toEqual([
+      { name: "weather", targetSlug: "weather-agent" },
+    ]);
+  });
+
+  it("throws on unknown peer slugs, listing the mounted agents", () => {
+    const mounts = [
+      {
+        slug: "concierge",
+        project: makeProject("concierge", [
+          { name: "weather", transport: { agent: "nope" } },
+        ]),
+      },
+      { slug: "weather-agent", project: makeProject("weather-agent") },
+    ];
+    expect(() => collectPeerConnections(mounts)).toThrow(
+      /unknown peer agent "nope".*weather-agent/
+    );
+  });
+
+  it("throws on self-references", () => {
+    const mounts = [
+      {
+        slug: "concierge",
+        project: makeProject("concierge", [
+          { name: "me", transport: { agent: "concierge" } },
+        ]),
+      },
+    ];
+    expect(() => collectPeerConnections(mounts)).toThrow(/references itself/);
+  });
+
+  it("rejects peers in single-agent mode (empty slug set)", () => {
+    const mounts = [
+      {
+        slug: "",
+        project: makeProject("solo", [
+          { name: "weather", transport: { agent: "weather-agent" } },
+        ]),
+      },
+    ];
+    expect(() => collectPeerConnections(mounts)).toThrow(
+      /Mounted agents: \(none\)/
+    );
+  });
+});
+
+describe("resolvePeerConnections", () => {
+  const refs = [{ name: "weather", targetSlug: "weather-agent" }];
+
+  it("resolves loopback URLs and omits cloudUrl without a publicUrl", () => {
+    const peers = resolvePeerConnections({
+      refs,
+      serverUrl: "http://127.0.0.1:4123",
+    });
+    expect(peers).toEqual([
+      {
+        name: "weather",
+        localUrl: "http://127.0.0.1:4123/weather-agent/v1/mcp",
+      },
+    ]);
+  });
+
+  it("resolves cloudUrl from publicUrl and attaches the bearer token", () => {
+    const peers = resolvePeerConnections({
+      refs,
+      serverUrl: "http://127.0.0.1:4123/",
+      publicUrl: "https://agents.example.com/",
+      authToken: "sekret",
+    });
+    expect(peers).toEqual([
+      {
+        name: "weather",
+        localUrl: "http://127.0.0.1:4123/weather-agent/v1/mcp",
+        cloudUrl: "https://agents.example.com/weather-agent/v1/mcp",
+        headers: { authorization: "Bearer sekret" },
+      },
+    ]);
+  });
+});