@debugg-ai/debugg-ai-mcp 3.7.2 → 3.7.3

package/dist/services/ngrok/tunnelManager.js

@@ -18,7 +18,7 @@
  */
 import { Logger } from '../../utils/logger.js';
 import { Telemetry, TelemetryEvents } from '../../utils/telemetry.js';
-import { isLocalhostUrl, extractLocalhostPort, generateTunnelUrl } from '../../utils/urlParser.js';
+import { isLocalhostUrl, extractLocalhostPort, generateTunnelUrl, retargetTunnelUrl } from '../../utils/urlParser.js';
 import { v4 as uuidv4 } from 'uuid';
 import { FaultInjector, TunnelTrace, getFaultModeFromEnv } from './tunnelFaultInjection.js';
 import { getDefaultRegistry, } from './tunnelRegistry.js';
@@ -262,9 +262,11 @@ class TunnelManager {
         // 1. Check local in-process map (handles owned + borrowed with liveness check)
         const existing = this.getTunnelForPort(port);
         if (existing) {
-            logger.info(`Reusing existing tunnel for port ${port}: ${existing.publicUrl}`);
+            // Bead zmc9: retarget to THIS caller's path; publicUrl carries the creator's.
+            const url_ = retargetTunnelUrl(existing.tunnelUrl, url);
+            logger.info(`Reusing existing tunnel for port ${port}: ${url_}`);
             Telemetry.capture(TelemetryEvents.TUNNEL_PROVISIONED, { port, how: 'reused' });
-            return { url: existing.publicUrl, tunnelId: existing.tunnelId, isLocalhost: true };
+            return { url: url_, tunnelId: existing.tunnelId, isLocalhost: true };
         }
         // 2. Deduplicate concurrent creation requests for the same port
         const pending = this.pendingTunnels.get(port);
@@ -277,7 +279,8 @@ class TunnelManager {
                 revokeKey().catch((err) => logger.warn(`Failed to revoke redundant key while joining pending tunnel for port ${port}:`, err));
             }
             const info = await pending;
-            return { url: info.publicUrl, tunnelId: info.tunnelId, isLocalhost: true };
+            // Bead zmc9: retarget to THIS caller's path, not the in-flight creator's.
+            return { url: retargetTunnelUrl(info.tunnelUrl, url), tunnelId: info.tunnelId, isLocalhost: true };
         }
         // 3. Check cross-process registry — another MCP instance may own a tunnel.
         //    Borrow only if the entry is fresh (PID alive AND touched within
@@ -303,7 +306,9 @@ class TunnelManager {
             this.reg.write(registry);
             this.resetTunnelTimer(borrowed);
             Telemetry.capture(TelemetryEvents.TUNNEL_PROVISIONED, { port, how: 'borrowed' });
-            return { url: regEntry.publicUrl, tunnelId: regEntry.tunnelId, isLocalhost: true };
+            // Bead zmc9: retarget to THIS caller's path; regEntry.publicUrl carries the
+            // owning PID's creating-call path — replaying it is the cross-session poison.
+            return { url: retargetTunnelUrl(regEntry.tunnelUrl, url), tunnelId: regEntry.tunnelId, isLocalhost: true };
         }
         // 4. Create a new tunnel (this process becomes the owner)
         const creationPromise = this.createTunnel(url, port, tunnelId, authToken, keyId, revokeKey);

package/dist/utils/tunnelContext.js

@@ -7,7 +7,7 @@
  *  - sanitizing backend responses so callers only ever see the original URL
  */
 import { tunnelManager } from '../services/ngrok/tunnelManager.js';
-import { isLocalhostUrl, replaceTunnelUrls, extractLocalhostPort } from './urlParser.js';
+import { isLocalhostUrl, replaceTunnelUrls, extractLocalhostPort, retargetTunnelUrl } from './urlParser.js';
 // ─── URL resolution ──────────────────────────────────────────────────────────
 /**
  * Resolve tool input to a concrete URL string.
@@ -43,7 +43,13 @@ export function findExistingTunnel(ctx) {
     if (!existing)
         return null;
     tunnelManager.touchTunnel(existing.tunnelId);
-    return { ...ctx, tunnelId: existing.tunnelId, targetUrl: existing.publicUrl };
+    // Bead zmc9: retarget to THIS caller's path — never replay existing.publicUrl,
+    // which carries the path of whichever call created the (port-keyed) tunnel.
+    return {
+        ...ctx,
+        tunnelId: existing.tunnelId,
+        targetUrl: retargetTunnelUrl(existing.tunnelUrl, ctx.originalUrl),
+    };
 }
 /**
  * Create (or reuse) a tunnel for a localhost URL.

package/dist/utils/urlParser.js

@@ -107,6 +107,28 @@ export function replaceTunnelUrls(value, localhostOrigin) {
     }
     return value;
 }
+/**
+ * Re-point a REUSED tunnel at the current caller's path (bead zmc9).
+ *
+ * A tunnel is origin-scoped: its `tunnelUrl` (scheme://host from ngrok) forwards
+ * every path. The path is request-scoped. On reuse we must compose the reused
+ * tunnel's ORIGIN with THIS request's path/search/hash — never replay the
+ * path-bearing `publicUrl` baked in by whichever call created the tunnel.
+ *
+ * @param tunnelOrigin the reused tunnel's path-free origin (TunnelInfo.tunnelUrl)
+ * @param requestedUrl the localhost URL the current caller asked for
+ */
+export function retargetTunnelUrl(tunnelOrigin, requestedUrl) {
+    try {
+        const origin = new URL(tunnelOrigin);
+        const parsed = parseUrl(requestedUrl);
+        return `${origin.protocol}//${origin.host}${parsed.pathname}${parsed.search}${parsed.hash}`;
+    }
+    catch {
+        // Never fabricate a path: fall back to the bare origin, not a foreign path.
+        return tunnelOrigin;
+    }
+}
 /**
  * Generate a tunneled URL for a localhost URL
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugg-ai/debugg-ai-mcp",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "Zero-Config, Fully AI-Managed End-to-End Testing for all code gen platforms.",
   "type": "module",
   "bin": {