@dobbyai/mcp-external 1.0.4 → 1.2.0

package/dist/__tests__/server-user-scoped.test.js

@@ -0,0 +1,577 @@
+/**
+ * Server HTTP-mode User-Scoped PAT Routing Tests (ADR-020 W1b/W1c/W2)
+ *
+ * A user-scoped PAT (`dobby_pat_*`) carries NO tenant/org pin — the introspect
+ * endpoint returns `user_scoped: true` with `tenant_id: null` / `org_id: null`
+ * and the AGGREGATE (max) role. The CallTool handler must therefore resolve the
+ * per-call target from the tool ARGUMENTS, not from the token:
+ *
+ *  - ORG_CLIENT_TOOLS (memory_store_*, rubric_*, orchestration_config_list) →
+ *    require an `org_id` arg, which becomes client.organizationId + ctx.orgId;
+ *    tenantId stays undefined. Missing → helpful error, handleToolCall NOT run.
+ *  - ORG_ARG_TOOLS (export_policies, validate_policies, apply_guardrail,
+ *    import_policies) → carry their own `organization_id`; the branch must NOT
+ *    demand a tenant_id.
+ *  - everything else is tenant-scoped → require a `tenant_id` arg → ctx.tenantId,
+ *    plus a per-TENANT-memoized gk_tmp_ provider on the client. Missing → error.
+ *  - ListTools for a user-scoped session appends the two synthetic discovery
+ *    tools (list_my_tenants + list_my_orgs); a tenant-pinned session gets neither.
+ *
+ * Drives the REAL server factory (server.ts) over real Streamable HTTP with a
+ * stub introspection issuer — only tools/index.handleToolCall is spied, so we
+ * inspect the exact ToolContext the handler built, and we also return the parsed
+ * tools/call JSON-RPC result so the "missing arg" branches can assert isError.
+ *
+ * Fixture note — `tenant_role: 'tenant_owner'` (NOT the plain `'owner'` shown in
+ * the ADR-020 ticket example): introspection emits roles in the capability-core
+ * vocabulary (web `aggregate-roles.ts` maps DB `owner` → `tenant_owner`), and the
+ * MCP role-cap (capability-core `roleCapAllows`) only recognizes `tenant_owner`
+ * — `'owner'` is an unknown role and fails the cap (verified), which would make
+ * every call hit a role denial before handleToolCall. `tenant_owner` is the real
+ * in-band value and satisfies the spec's intent (calls reach handleToolCall).
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const { handleToolCallSpy } = vi.hoisted(() => ({
+    handleToolCallSpy: vi.fn(),
+}));
+vi.mock('../tools/index.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        handleToolCall: handleToolCallSpy,
+    };
+});
+/** Streamable HTTP responses may arrive as SSE — take the last data line. */
+function parseRpc(text) {
+    const dataLines = text
+        .split('\n')
+        .filter((line) => line.startsWith('data: '));
+    if (dataLines.length > 0) {
+        return JSON.parse(dataLines[dataLines.length - 1].slice(6));
+    }
+    return JSON.parse(text);
+}
+/** The user-scoped introspection payload (ADR-020): no tenant/org pin, aggregate role. */
+function userScopedIntrospect() {
+    return {
+        active: true,
+        user_id: 'pu_x',
+        user_scoped: true,
+        tenant_id: null,
+        org_id: null,
+        tenant_role: 'tenant_owner',
+        org_role: 'org_owner',
+        scope: 'mcp:*',
+        client_id: 'key_x',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+    };
+}
+/**
+ * Spin up a stub issuer + the real HTTP server, run initialize → tools/call with
+ * the given bearer + tool + args, and return BOTH the captured ToolContext (or
+ * null) and the parsed JSON-RPC result.
+ */
+async function callToolOverHttp(opts) {
+    const express = (await import('express')).default;
+    const { startHttpServer } = await import('../http-server.js');
+    const { createServer } = await import('../server.js');
+    const introspectBody = opts.introspect ?? userScopedIntrospect();
+    const issuer = express();
+    issuer.use(express.json());
+    issuer.post('/oauth/token/introspect', (_req, res) => {
+        res.json(introspectBody);
+    });
+    const issuerServer = issuer.listen(0);
+    const issuerPort = issuerServer.address().port;
+    const { server, tokenVerifier } = await startHttpServer({
+        port: 0,
+        issuerUrl: `http://127.0.0.1:${issuerPort}`,
+        mcpPublicUrl: 'http://127.0.0.1:0',
+        createMcpServer: () => createServer({ mode: 'http' }),
+    });
+    const mcpPort = server.address().port;
+    const mcpUrl = `http://127.0.0.1:${mcpPort}/mcp`;
+    const headers = {
+        Authorization: `Bearer ${opts.bearer}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+    };
+    let result;
+    try {
+        const initRes = await fetch(mcpUrl, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    capabilities: {},
+                    clientInfo: { name: 'user-scoped-probe', version: '0' },
+                },
+            }),
+        });
+        expect(initRes.status).toBe(200);
+        const sessionId = initRes.headers.get('mcp-session-id');
+        const callRes = await fetch(mcpUrl, {
+            method: 'POST',
+            headers: { ...headers, 'Mcp-Session-Id': sessionId },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 2,
+                method: 'tools/call',
+                params: { name: opts.toolName, arguments: opts.args },
+            }),
+        });
+        expect(callRes.status).toBe(200);
+        result = parseRpc(await callRes.text());
+    }
+    finally {
+        tokenVerifier.clearCache();
+        server.close();
+        issuerServer.close();
+    }
+    const context = handleToolCallSpy.mock.calls.length > 0
+        ? handleToolCallSpy.mock.calls[0][2]
+        : null;
+    return { context, result };
+}
+/**
+ * Spin up a stub issuer + the real HTTP server, run initialize → tools/list with
+ * the given bearer, and return the list of tool names the server served.
+ */
+async function listToolsOverHttp(opts) {
+    const express = (await import('express')).default;
+    const { startHttpServer } = await import('../http-server.js');
+    const { createServer } = await import('../server.js');
+    const issuer = express();
+    issuer.use(express.json());
+    issuer.post('/oauth/token/introspect', (_req, res) => {
+        res.json(opts.introspect);
+    });
+    const issuerServer = issuer.listen(0);
+    const issuerPort = issuerServer.address().port;
+    const { server, tokenVerifier } = await startHttpServer({
+        port: 0,
+        issuerUrl: `http://127.0.0.1:${issuerPort}`,
+        mcpPublicUrl: 'http://127.0.0.1:0',
+        createMcpServer: () => createServer({ mode: 'http' }),
+    });
+    const mcpPort = server.address().port;
+    const mcpUrl = `http://127.0.0.1:${mcpPort}/mcp`;
+    const headers = {
+        Authorization: `Bearer ${opts.bearer}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+    };
+    try {
+        const initRes = await fetch(mcpUrl, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    capabilities: {},
+                    clientInfo: { name: 'user-scoped-list-probe', version: '0' },
+                },
+            }),
+        });
+        expect(initRes.status).toBe(200);
+        const sessionId = initRes.headers.get('mcp-session-id');
+        const listRes = await fetch(mcpUrl, {
+            method: 'POST',
+            headers: { ...headers, 'Mcp-Session-Id': sessionId },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 2,
+                method: 'tools/list',
+                params: {},
+            }),
+        });
+        expect(listRes.status).toBe(200);
+        const data = parseRpc(await listRes.text());
+        return data.result.tools.map((t) => t.name);
+    }
+    finally {
+        tokenVerifier.clearCache();
+        server.close();
+        issuerServer.close();
+    }
+}
+// The tenant set the stubbed /api/v1/me/tenants returns. Default is TWO tenants
+// so the single-tenant auto-select (resolveSoleTenant) declines (ambiguous) and
+// the existing missing-tenant_id tests still get needs_selection —
+// deterministically, with no real network call. Tests override it per-case.
+let stubTenants = [
+    { tenant_id: 'tenant_a' },
+    { tenant_id: 'tenant_b' },
+];
+const realFetch = globalThis.fetch.bind(globalThis);
+describe('CallTool handler — user-scoped PAT routing (ADR-020, HTTP mode)', () => {
+    beforeEach(() => {
+        handleToolCallSpy.mockReset().mockResolvedValue({
+            content: [{ type: 'text', text: 'ok' }],
+        });
+        stubTenants = [{ tenant_id: 'tenant_a' }, { tenant_id: 'tenant_b' }];
+        // Intercept ONLY the user-scoped tenant lookup; pass the in-process MCP
+        // round-trip (127.0.0.1/mcp) through to the real fetch.
+        vi.stubGlobal('fetch', (url, init) => {
+            if (String(url).includes('/api/v1/me/tenants')) {
+                return Promise.resolve({
+                    ok: true,
+                    json: () => Promise.resolve({ tenants: stubTenants }),
+                });
+            }
+            return realFetch(url, init);
+        });
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.unstubAllEnvs();
+    });
+    it('org-scoped tool sets client.organizationId from the org_id arg (tenantId undefined)', async () => {
+        const { context } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'memory_store_list',
+            args: { org_id: 'org_abc' },
+        });
+        expect(handleToolCallSpy).toHaveBeenCalledTimes(1);
+        expect(context).not.toBeNull();
+        expect(context.client.organizationId).toBe('org_abc');
+        expect(context.tenantId).toBeUndefined();
+        expect(context.orgId).toBe('org_abc');
+    });
+    it('org-scoped tool missing org_id → helpful error naming org_id + list_my_orgs, handler NOT called', async () => {
+        const { context, result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'memory_store_list',
+            args: {},
+        });
+        expect(handleToolCallSpy).not.toHaveBeenCalled();
+        expect(context).toBeNull();
+        expect(result.result.isError).toBe(true);
+        const text = result.result.content[0].text;
+        expect(text).toContain('org_id');
+        expect(text).toContain('list_my_orgs');
+    });
+    it('governance tool with its own organization_id does NOT require a tenant_id', async () => {
+        const { context } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'export_policies',
+            args: { organization_id: 'org_abc' },
+        });
+        // The ORG_ARG_TOOLS branch must not reject for a missing tenant_id.
+        expect(handleToolCallSpy).toHaveBeenCalledTimes(1);
+        expect(context).not.toBeNull();
+    });
+    // ADR-020 / ops-tools-parity: platform-scoped superadmin ops tools carry no
+    // tenant_id/org_id (they hit /api/v1/internal/ops/* server-to-server). A
+    // user-scoped connection must NOT be asked for a tenant_id for them — they are
+    // in PLATFORM_TOOLS. The RBAC gate runs first, so the introspect must carry
+    // is_super_admin:true (else the superAdminOnly gate rejects before resolution).
+    it('platform ops tool (superadmin) does NOT require a tenant_id', async () => {
+        const { context, result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'get_ops_health_summary',
+            args: {},
+            introspect: { ...userScopedIntrospect(), is_super_admin: true },
+        });
+        // PLATFORM_TOOLS branch: reaches the handler, no "no fixed tenant" rejection.
+        expect(handleToolCallSpy).toHaveBeenCalledTimes(1);
+        expect(context).not.toBeNull();
+        expect(context.tenantId).toBeUndefined();
+        // Mock handler result carries no isError (success shape) → not an error.
+        expect(result.result.isError).toBeFalsy();
+    });
+    // Security regression guard: superAdminOnly is enforced at CALL time (not just
+    // hidden from ListTools, which is cosmetic). WITHOUT super-admin the ops tool
+    // is denied by getToolAccessDenial BEFORE the handler — a non-superadmin can
+    // never invoke it by name, even with an enterprise-tier token.
+    it('platform ops tool without super-admin is denied at call time, handler NOT called', async () => {
+        const { context, result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'get_ops_health_summary',
+            args: {},
+            introspect: userScopedIntrospect(), // is_super_admin unset → false
+        });
+        expect(handleToolCallSpy).not.toHaveBeenCalled();
+        expect(context).toBeNull();
+        expect(result.result.isError).toBe(true);
+        const text = result.result.content[0].text;
+        // A superadmin denial, NOT the "no fixed tenant" tenant-demand message.
+        expect(text).toContain('super-admin');
+        expect(text).not.toContain('no fixed tenant');
+    });
+    it('gateway-scoped tool: tenantId from the arg, gatewayKey unset, provider resolves a per-tenant gk_tmp_ via the internal endpoint', async () => {
+        const { context } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'crew_list',
+            args: { tenant_id: 'tenant_a' },
+        });
+        expect(handleToolCallSpy).toHaveBeenCalledTimes(1);
+        expect(context).not.toBeNull();
+        expect(context.tenantId).toBe('tenant_a');
+        // gk_ pre-check key stays unset for a PAT session (the token is not a gk_).
+        expect(context.gatewayKey).toBeUndefined();
+        // The gateway key is resolved LAZILY — stub the exchange AFTER the HTTP tool
+        // call (the harness itself uses fetch for the MCP round-trip), exactly like
+        // the dobby_at_ memoized test does.
+        vi.stubEnv('INTERNAL_SERVICE_SECRET', 'it-secret');
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.resolve({
+                success: true,
+                data: { gateway_key: 'gk_tmp_a' },
+            }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        expect(await context.client.gatewayBearer()).toBe('gk_tmp_a');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        const [url] = fetchMock.mock.calls[0];
+        expect(String(url)).toContain('/api/v1/internal/mcp/gateway-key');
+    });
+    // ADR-020 W2: the per-call tenant_id MUST reach the internal minting endpoint
+    // in the request body so a PAT (which carries no tenant pin) mints + authorizes
+    // for the right tenant. server.ts passes `resolveSessionGatewayKey({ apiUrl,
+    // token, tenantId: t })` and the resolver serializes `{ tenant_id }` into the
+    // body (gateway-key-resolver.ts) — regression guard for the dropped-tenant bug.
+    it('gateway-scoped tool sends the per-call tenant_id in the internal-endpoint body', async () => {
+        const { context } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'crew_list',
+            args: { tenant_id: 'tenant_a' },
+        });
+        expect(context).not.toBeNull();
+        vi.stubEnv('INTERNAL_SERVICE_SECRET', 'it-secret');
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.resolve({
+                success: true,
+                data: { gateway_key: 'gk_tmp_a' },
+            }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        await context.client.gatewayBearer();
+        const [, init] = fetchMock.mock.calls[0];
+        // The per-call target tenant MUST reach the internal minting endpoint in
+        // the request body — this is what currently fails ('{}' has no tenant).
+        expect(String(init.body)).toContain('tenant_a');
+    });
+    it('tenant-scoped tool missing tenant_id → helpful error naming tenant_id + list_my_tenants', async () => {
+        const { context, result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'create_task',
+            args: {},
+        });
+        expect(handleToolCallSpy).not.toHaveBeenCalled();
+        expect(context).toBeNull();
+        expect(result.result.isError).toBe(true);
+        const text = result.result.content[0].text;
+        expect(text).toContain('tenant_id');
+        expect(text).toContain('list_my_tenants');
+    });
+    it('needs_selection is machine-readable JSON — org guard', async () => {
+        const { result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'memory_store_list',
+            args: {},
+        });
+        expect(result.result.isError).toBe(true);
+        const env = JSON.parse(result.result.content[0].text);
+        expect(env.status).toBe('needs_selection');
+        expect(env.select).toBe('organization');
+        expect(env.argument).toBe('org_id');
+        expect(env.list_tool).toBe('list_my_orgs');
+        expect(typeof env.message).toBe('string');
+    });
+    it('needs_selection is machine-readable JSON — tenant guard', async () => {
+        const { result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'create_task',
+            args: {},
+        });
+        expect(result.result.isError).toBe(true);
+        const env = JSON.parse(result.result.content[0].text);
+        expect(env.status).toBe('needs_selection');
+        expect(env.select).toBe('tenant');
+        expect(env.argument).toBe('tenant_id');
+        expect(env.list_tool).toBe('list_my_tenants');
+    });
+    // Short-prompt UX: a user with exactly ONE tenant should never be asked which
+    // one — the tenant branch auto-selects it via resolveSoleTenant, so a missing
+    // tenant_id proceeds to the handler with that tenant instead of needs_selection.
+    it('tenant-scoped tool with no tenant_id auto-selects the SOLE tenant', async () => {
+        stubTenants = [{ tenant_id: 'tenant_solo' }];
+        const { context, result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'create_task',
+            args: {},
+        });
+        expect(result.result.isError).toBeFalsy();
+        expect(handleToolCallSpy).toHaveBeenCalledTimes(1);
+        expect(context).not.toBeNull();
+        expect(context.tenantId).toBe('tenant_solo');
+    });
+    it('resolveSoleTenant: exactly one → id; zero or many → null', async () => {
+        const { resolveSoleTenant } = await import('../server.js');
+        stubTenants = [{ tenant_id: 'tenant_only' }];
+        expect(await resolveSoleTenant('http://api', 'dobby_pat_test')).toBe('tenant_only');
+        stubTenants = [];
+        expect(await resolveSoleTenant('http://api', 'dobby_pat_test')).toBeNull();
+        stubTenants = [{ tenant_id: 'a' }, { tenant_id: 'b' }];
+        expect(await resolveSoleTenant('http://api', 'dobby_pat_test')).toBeNull();
+    });
+    it('needs_pat is a machine-readable JSON envelope naming the env var + prefix', async () => {
+        const { needsPatResult } = await import('../server.js');
+        const res = needsPatResult('list the tenants you can act in', '401 body');
+        expect(res.isError).toBe(true);
+        const env = JSON.parse(res.content[0].text);
+        expect(env.status).toBe('needs_pat');
+        expect(env.token_prefix).toBe('dobby_pat_');
+        expect(env.env_var).toBe('DOBBY_API_KEY');
+        expect(env.unlocks).toContain('tenants');
+        expect(env.message).toContain('dobby_pat_');
+    });
+});
+describe('ListTools — synthetic discovery tools by session shape (HTTP mode)', () => {
+    it('a user-scoped session gets both list_my_tenants AND list_my_orgs', async () => {
+        const names = await listToolsOverHttp({
+            bearer: 'dobby_pat_test',
+            introspect: userScopedIntrospect(),
+        });
+        expect(names).toContain('list_my_tenants');
+        expect(names).toContain('list_my_orgs');
+    });
+    it('a tenant-pinned (non-user-scoped) session gets NEITHER discovery tool', async () => {
+        const names = await listToolsOverHttp({
+            bearer: 'dobby_at_test',
+            introspect: {
+                active: true,
+                user_id: 'pu_pinned',
+                // no user_scoped flag — a normal tenant-pinned OAuth session
+                tenant_id: 'tenant_pinned',
+                org_id: 'org_pinned',
+                tenant_role: 'tenant_owner',
+                org_role: 'org_owner',
+                scope: 'mcp:*',
+                client_id: 'key_pinned',
+                exp: Math.floor(Date.now() / 1000) + 3600,
+            },
+        });
+        expect(names).not.toContain('list_my_tenants');
+        expect(names).not.toContain('list_my_orgs');
+    });
+});
+describe('whoami — identity echo over HTTP (both session shapes)', () => {
+    it('a user-scoped session lists whoami AND it returns the http/user-scoped identity', async () => {
+        const names = await listToolsOverHttp({
+            bearer: 'dobby_pat_test',
+            introspect: userScopedIntrospect(),
+        });
+        expect(names).toContain('whoami');
+        const { result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'whoami',
+            args: {},
+            introspect: userScopedIntrospect(),
+        });
+        expect(result.result.isError).toBe(false);
+        const text = result.result.content[0].text;
+        expect(text).toContain('transport: http');
+        expect(text).toContain('user_scoped: true');
+        // no tenant pin → whoami should prompt for a per-call tenant_id
+        expect(text).toContain('tenant_id');
+        expect(text).toContain('list_my_tenants');
+    });
+    it('a tenant-pinned session lists whoami AND it resolves the pinned tenant/org', async () => {
+        const pinned = {
+            active: true,
+            user_id: 'pu_pinned',
+            tenant_id: 'tenant_pinned',
+            org_id: 'org_pinned',
+            tenant_role: 'tenant_owner',
+            org_role: 'org_owner',
+            scope: 'mcp:*',
+            client_id: 'key_pinned',
+            exp: Math.floor(Date.now() / 1000) + 3600,
+        };
+        const names = await listToolsOverHttp({ bearer: 'dobby_at_test', introspect: pinned });
+        expect(names).toContain('whoami');
+        const { result } = await callToolOverHttp({
+            bearer: 'dobby_at_test',
+            toolName: 'whoami',
+            args: {},
+            introspect: pinned,
+        });
+        expect(result.result.isError).toBe(false);
+        const text = result.result.content[0].text;
+        expect(text).toContain('tenant_id: tenant_pinned');
+        expect(text).toContain('organization_id: org_pinned');
+        expect(text).toContain('user_scoped: false');
+    });
+});
+describe('validate_credentials — over HTTP', () => {
+    it('a user-scoped session lists it AND it reports authorized (introspection passed)', async () => {
+        const names = await listToolsOverHttp({
+            bearer: 'dobby_pat_test',
+            introspect: userScopedIntrospect(),
+        });
+        expect(names).toContain('validate_credentials');
+        const { result } = await callToolOverHttp({
+            bearer: 'dobby_pat_test',
+            toolName: 'validate_credentials',
+            args: {},
+            introspect: userScopedIntrospect(),
+        });
+        expect(result.result.isError).toBe(false);
+        const text = result.result.content[0].text;
+        expect(text).toContain('credential validation');
+        expect(text).toContain('"authorized": true');
+        // user-scoped without a tenant pin → prompts for tenant_id
+        expect(text).toContain('tenant_id');
+    });
+});
+describe('CallTool handler — tenant-pinned org context (regression, 2026-07-20)', () => {
+    const pinnedIntrospect = {
+        active: true,
+        user_id: 'pu_pinned',
+        tenant_id: 'tenant_pinned',
+        org_id: 'org_pinned',
+        tenant_role: 'tenant_owner',
+        org_role: 'org_owner',
+        scope: 'mcp:*',
+        client_id: 'key_pinned',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+    };
+    beforeEach(() => {
+        handleToolCallSpy.mockReset().mockResolvedValue({
+            content: [{ type: 'text', text: 'ok' }],
+        });
+    });
+    // Regression: a tenant-pinned OAuth (dobby_at_) / sk_live_ session carries
+    // org_id in the token, but the per-request client used to be built WITHOUT
+    // organizationId (only the user-scoped PAT branch set it from an arg). So
+    // ORG-scoped tools (memory_store_*, rubric_*, orchestration_config_list) —
+    // which read client.organizationId — returned "No organization context" for
+    // every OAuth/sk_live_ session even though whoami showed the org (customer
+    // hit 2026-07-20). The pinned branch must copy tokenExtra.org_id onto the
+    // client. handleToolCall is spied, so we assert on the ToolContext it built.
+    it('org-scoped tool gets client.organizationId from the pinned token org_id', async () => {
+        const { context } = await callToolOverHttp({
+            bearer: 'dobby_at_test',
+            toolName: 'memory_store_list',
+            args: {},
+            introspect: pinnedIntrospect,
+        });
+        expect(handleToolCallSpy).toHaveBeenCalledTimes(1);
+        expect(context).not.toBeNull();
+        expect(context.client.organizationId).toBe('org_pinned');
+        expect(context.tenantId).toBe('tenant_pinned');
+        expect(context.orgId).toBe('org_pinned');
+    });
+});
+//# sourceMappingURL=server-user-scoped.test.js.map

package/dist/__tests__/server-user-scoped.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-user-scoped.test.js","sourceRoot":"","sources":["../../src/__tests__/server-user-scoped.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGzE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC3B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAsC,CAAC;IAC1E,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,iBAAiB;KAClC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,SAAS,GAAG,IAAI;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAgBD,0FAA0F;AAC1F,SAAS,oBAAoB;IAC3B,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,OAAO;QACd,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;KAC1C,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAK/B;IACC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEtD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,EAAE,CAAC;IAEjE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,UAAU,GAAI,YAAY,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAErE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,eAAe,CAAC;QACtD,IAAI,EAAE,CAAC;QACP,SAAS,EAAE,oBAAoB,UAAU,EAAE;QAC3C,YAAY,EAAE,oBAAoB;QAClC,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,OAAO,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,oBAAoB,OAAO,MAAM,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,qCAAqC;KAC9C,CAAC;IAEF,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,EAAE;iBACxD;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC;QAEzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE;YACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE;aACtD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GACX,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAiB;QACrD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAGhC;IACC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,UAAU,GAAI,YAAY,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAErE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,eAAe,CAAC;QACtD,IAAI,EAAE,CAAC;QACP,SAAS,EAAE,oBAAoB,UAAU,EAAE;QAC3C,YAAY,EAAE,oBAAoB;QAClC,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,OAAO,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,oBAAoB,OAAO,MAAM,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,qCAAqC;KAC9C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,GAAG,EAAE;iBAC7D;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC;QAEzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE;YACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,OAAQ,IAAI,CAAC,MAAM,CAAC,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,mEAAmE;AACnE,4EAA4E;AAC5E,IAAI,WAAW,GAAiC;IAC9C,EAAE,SAAS,EAAE,UAAU,EAAE;IACzB,EAAE,SAAS,EAAE,UAAU,EAAE;CAC1B,CAAC;AACF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAEpD,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC/E,UAAU,CAAC,GAAG,EAAE;QACd,iBAAiB,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,WAAW,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,wEAAwE;QACxE,wDAAwD;QACxD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,IAAU,EAAE,EAAE;YAC9C,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;iBAC1C,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACjD,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE;SACrC,CAAC,CAAC;QAEH,oEAAoE;QACpE,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACjD,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,wBAAwB;YAClC,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,EAAE,GAAG,oBAAoB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;SAChE,CAAC,CAAC;QAEH,8EAA8E;QAC9E,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1C,yEAAyE;QACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,+DAA+D;IAC/D,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACjD,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,wBAAwB;YAClC,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,oBAAoB,EAAE,EAAE,+BAA+B;SACpE,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;QACrD,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gIAAgI,EAAE,KAAK,IAAI,EAAE;QAC9I,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;SAChC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,4EAA4E;QAC5E,MAAM,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAE5C,6EAA6E;QAC7E,4EAA4E;QAC5E,oCAAoC;QACpC,EAAE,CAAC,OAAO,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YAC1C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;aAClC,CAAC;SACL,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,CAAC,MAAM,OAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,EAAE,CACA,gFAAgF,EAChF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAE/B,EAAE,CAAC,OAAO,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YAC1C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;aAClC,CAAC;SACL,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,OAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACjD,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,8EAA8E;IAC9E,iFAAiF;IACjF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,WAAW,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACjD,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3D,WAAW,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAClE,aAAa,CACd,CAAC;QACF,WAAW,GAAG,EAAE,CAAC;QACjB,MAAM,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,WAAW,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,cAAc,CAAC,iCAAiC,EAAE,UAAU,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAClF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,oBAAoB,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;YACpC,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE;gBACV,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,WAAW;gBACpB,6DAA6D;gBAC7D,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,cAAc;gBAC3B,QAAQ,EAAE,WAAW;gBACrB,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,YAAY;gBACvB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;aAC1C;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,oBAAoB,EAAE;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAElC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,oBAAoB,EAAE;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC5C,gEAAgE;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,MAAM,GAAuB;YACjC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,eAAe;YAC1B,MAAM,EAAE,YAAY;YACpB,WAAW,EAAE,cAAc;YAC3B,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,YAAY;YACvB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAC1C,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAElC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,oBAAoB,EAAE;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAEhD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACxC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,sBAAsB;YAChC,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,oBAAoB,EAAE;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC7C,2DAA2D;QAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,MAAM,gBAAgB,GAAuB;QAC3C,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,YAAY;QACpB,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,OAAO;QACd,SAAS,EAAE,YAAY;QACvB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;KAC1C,CAAC;IAEF,UAAU,CAAC,GAAG,EAAE;QACd,iBAAiB,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/task-id-pattern.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Regression: the task-id input pattern must accept every id the platform
+ * actually issues, not just the `task_` shape.
+ *
+ * The MCP create_task tool posts to /api/dobby/tasks, which generates ids like
+ * `task-1784122598603-vjtbfh` (a HYPHEN after "task"). The old input pattern
+ * `^task_[a-zA-Z0-9_-]+$` required an UNDERSCORE, so an id returned by
+ * create_task failed schema validation on cancel_task / get_task / update_task /
+ * get_task_timeline — a task created via MCP could not be acted on via MCP.
+ */
+export {};
+//# sourceMappingURL=task-id-pattern.test.d.ts.map

package/dist/__tests__/task-id-pattern.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-id-pattern.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/task-id-pattern.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}