@debugg-ai/debugg-ai-mcp 6.0.1 → 6.0.3

package/dist/handlers/triggerCrawlHandler.js

@@ -11,7 +11,7 @@
  * and reports back what happened.
  */
 import { config } from '../config/index.js';
-import { toUserFacingOutcome, noVerdictReason } from '../services/verdictAdapter.js';
+import { adaptVerdict } from '../services/verdictAdapter.js';
 import { Logger } from '../utils/logger.js';
 import { handleExternalServiceError } from '../utils/errors.js';
 import { DebuggAIServerClient } from '../services/index.js';
@@ -290,24 +290,24 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
             targetUrl: ctx.originalUrl,
             durationMs: finalExecution.durationMs ?? duration,
         };
-        // Map onto the user-facing enum instead of relaying raw. This path never
-        // went through adaptVerdict, so it would otherwise emit whatever the
-        // backend sent — including retired non-answers like 'inconclusive'.
-        const rawOutcome = finalExecution.state?.outcome;
-        if (finalExecution.verdict?.skipped === true && !finalExecution.verdict.outcome) {
+        // THE run verdict (platform-4cvj.72): the backend's recorded `verdict`, through
+        // the same adaptVerdict path check_app_in_browser uses — never the raw
+        // `state.outcome` (the run's internal record), which can say pass for a run
+        // the verdict calls error. No verdict yet (still running) -> outcome null.
+        const relay = adaptVerdict(finalExecution);
+        responsePayload.outcome = relay.outcome;
+        if (relay.skipped) {
             // platform-98fv.16: the run never attempted a test — no verdict, the
-            // backend's recorded reason verbatim. Never the raw run outcome.
-            responsePayload.outcome = null;
+            // backend's recorded reason verbatim.
             responsePayload.skipped = true;
-            const skipReason = finalExecution.verdict.reason;
-            if (typeof skipReason === 'string' && skipReason.trim() !== '')
-                responsePayload.skipReason = skipReason;
+            if (relay.skipReason)
+                responsePayload.skipReason = relay.skipReason;
         }
-        else if (rawOutcome !== undefined && rawOutcome !== null) {
-            responsePayload.outcome = toUserFacingOutcome(rawOutcome);
-            if (responsePayload.outcome === 'error' && !finalExecution.errorMessage) {
-                responsePayload.reason = noVerdictReason(rawOutcome);
-            }
+        else if (relay.outcome === 'error' && relay.reason) {
+            const backendReason = typeof finalExecution.verdict?.reason === 'string'
+                && finalExecution.verdict.reason.trim() !== '';
+            if (backendReason || !finalExecution.errorMessage)
+                responsePayload.reason = relay.reason;
         }
         if (finalExecution.errorMessage)
             responsePayload.errorMessage = finalExecution.errorMessage;

package/dist/services/index.js

@@ -41,6 +41,22 @@ function pickAuthorizedCredentialHosts(e) {
         ? { authorizedCredentialHosts: e.authorizedCredentialHosts }
         : {};
 }
+/**
+ * The outcome a suite's run SHOWS (platform-4cvj.72): the run's recorded verdict
+ * when the backend sent one, else its raw `outcome`, both through the user-facing
+ * allowlist. A run with neither keeps its null.
+ */
+export function suiteRunOutcome(run) {
+    const verdict = run?.verdict;
+    const fromVerdict = verdict && typeof verdict === 'object' ? verdict.outcome : undefined;
+    if (typeof fromVerdict === 'string' && fromVerdict.trim() !== '') {
+        return toUserFacingOutcome(fromVerdict);
+    }
+    const raw = run?.outcome;
+    if (typeof raw === 'string' && raw.trim() !== '')
+        return toUserFacingOutcome(raw);
+    return raw ?? null;
+}
 export class DebuggAIServerClient {
     userApiKey;
     tx;
@@ -604,11 +620,11 @@ export class DebuggAIServerClient {
                     lastRun: lastRun ? {
                         uuid: lastRun.uuid,
                         status: lastRun.status,
-                        // the user-facing verdict allowlist, same as every other surface;
-                        // a run with no outcome yet keeps its null
-                        outcome: typeof lastRun.outcome === 'string' && lastRun.outcome.trim() !== ''
-                            ? toUserFacingOutcome(lastRun.outcome)
-                            : lastRun.outcome ?? null,
+                        // platform-4cvj.72: THE run verdict (`verdict.outcome`, what the run
+                        // page shows) wins; the raw recorded `outcome` is only read for a run
+                        // the backend sent no verdict for. Same user-facing allowlist as every
+                        // other surface; a run with no outcome yet keeps its null.
+                        outcome: suiteRunOutcome(lastRun),
                         executionTime: lastRun.executionTime ?? lastRun.execution_time ?? null,
                         timestamp: lastRun.timestamp,
                     } : null,

package/dist/services/workflows.js

@@ -3,6 +3,7 @@
  * 4-step integration: find template → execute → poll → result
  */
 import { Telemetry, TelemetryEvents } from '../utils/telemetry.js';
+import { redactRunSecrets } from '../utils/redactRunSecrets.js';
 const TERMINAL_STATUSES = new Set(['completed', 'failed', 'cancelled']);
 // Exponential backoff polling: short executions (10-15s crawls) detect terminal
 // status quickly via the early polls; long executions (60-150s browser runs)
@@ -75,7 +76,9 @@ export const createWorkflowsService = (tx) => {
             if (!response) {
                 throw new Error(`Execution not found: ${executionUuid}`);
             }
-            return response;
+            // platform-98fv.25: every caller (executions tool, check_app polling) reads
+            // the execution through here, so this is where the relay drops run secrets.
+            return redactRunSecrets(response);
         },
         async listExecutions(filters) {
             const { makePageInfo } = await import('../utils/pagination.js');

package/dist/utils/redactRunSecrets.js

@@ -0,0 +1,40 @@
+/**
+ * platform-98fv.25: the relay never passes a run secret on.
+ *
+ * The backend used to persist the password a check_app_in_browser run was given
+ * and serve it back in `contextData.env.password`, `state.env.password` and every
+ * node payload. The backend now seals it at rest and redacts it on read; this is
+ * the relay's own copy of that rule, so an older or misbehaving backend still
+ * cannot leak through the MCP.
+ *
+ * Deliberately narrow and exact (mirrors sentinal `run_secrets.redact_run_secrets`):
+ *   - any non-empty string under a key named exactly `password` / `passwd`;
+ *   - every string value of a `projectSecrets` / `project_secrets` mapping;
+ *   - any string carrying the backend's sealed-value prefix.
+ * Identifiers such as `browserSessionId` / `resolvedCredentialId` are untouched.
+ */
+export const REDACTED = '[REDACTED]';
+const SEALED_PREFIX = 'sealed:v1:';
+const SECRET_KEYS = new Set(['password', 'passwd']);
+const SECRET_MAPPING_KEYS = new Set(['projectSecrets', 'project_secrets']);
+function isSealed(v) {
+    return typeof v === 'string' && v.startsWith(SEALED_PREFIX);
+}
+export function redactRunSecrets(value, inMapping = false) {
+    if (Array.isArray(value)) {
+        return value.map((v) => (isSealed(v) ? REDACTED : redactRunSecrets(v)));
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (typeof v === 'string' && v && (inMapping || SECRET_KEYS.has(k) || isSealed(v))) {
+                out[k] = REDACTED;
+            }
+            else {
+                out[k] = redactRunSecrets(v, SECRET_MAPPING_KEYS.has(k));
+            }
+        }
+        return out;
+    }
+    return value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugg-ai/debugg-ai-mcp",
-  "version": "6.0.1",
+  "version": "6.0.3",
   "description": "Zero-Config, Fully AI-Managed End-to-End Testing for all code gen platforms.",
   "type": "module",
   "caddy": "2.11.3",