@emseepea/create-progress-streaming-server 0.0.14 → 0.0.19

package/README.md

@@ -46,7 +46,8 @@ bodies, arguments, results, tokens, provider claims, or raw errors. See the
 Choose this example when a tool takes long enough that people benefit from
 seeing progress before the final answer.
 
-The public tool reports progress during its request. A client can ask for
+The tool reports progress during its request. It can use the public access shown
+in the template or the protected access described above. A client can ask for
 server-sent events (SSE), which carry progress over the same `POST` request.
 Without that request, the tool returns one JSON response when it finishes.
 
@@ -63,11 +64,18 @@ npm start
 The server listens on `http://127.0.0.1:3000/mcp` by default. Set `PORT` to
 choose another port. This example starts locally and does not configure a proxy.
 
-To adapt it for a public server, see
+To adapt it for a deployed server, see
 [Use Progress Behind a Proxy](https://github.com/emseepea/emseepea/blob/main/packages/framework/README.md#use-progress-behind-a-proxy).
 It does not add saved sessions, replay, subscriptions, or recovery after
 reconnecting.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Example
 
 [Ordinary tests](test/) live in `test/`.

package/initializer-dist/template/README.md

@@ -27,7 +27,8 @@ bodies, arguments, results, tokens, provider claims, or raw errors. See the
 Choose this example when a tool takes long enough that people benefit from
 seeing progress before the final answer.
 
-The public tool reports progress during its request. A client can ask for
+The tool reports progress during its request. It can use the public access shown
+in the template or the protected access described above. A client can ask for
 server-sent events (SSE), which carry progress over the same `POST` request.
 Without that request, the tool returns one JSON response when it finishes.
 
@@ -44,11 +45,18 @@ npm start
 The server listens on `http://127.0.0.1:3000/mcp` by default. Set `PORT` to
 choose another port. This example starts locally and does not configure a proxy.
 
-To adapt it for a public server, see
+To adapt it for a deployed server, see
 [Use Progress Behind a Proxy](https://github.com/emseepea/emseepea/blob/main/packages/framework/README.md#use-progress-behind-a-proxy).
 It does not add saved sessions, replay, subscriptions, or recovery after
 reconnecting.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Example
 
 [Ordinary tests](test/) live in `test/`.

package/initializer-dist/template/eval/meaning.test.mjs

@@ -1,15 +1,23 @@
 import test from "node:test";
 import {
   assertNoToolCalls,
+  assertNoNegativeFeedback,
   assertResponseContains,
   assertResponseMeaning,
-  assertToolCalls,
+  assertToolCallsWithOptionalFeedback,
   createConversation,
 } from "@emseepea/testing/semantic";
 
+const server = new URL(import.meta.resolve("@emseepea/feedback/testing-server"));
+const environment = {
+  EMSEEPEA_EVAL_APP_MODULE: new URL("../dist/app.js", import.meta.url).href,
+  EMSEEPEA_EVAL_APP_FACTORY: "createProgressStreamingServer",
+};
+
 test("keeps progress stages distinct from the completed result", async (t) => {
   const chat = await createConversation(t, {
-    server: new URL("../dist/server.js", import.meta.url),
+    server,
+    environment,
   });
 
   // The judge checks the important progress-versus-result distinction once.
@@ -18,7 +26,7 @@ test("keeps progress stages distinct from the completed result", async (t) => {
     "Run the sample-tray pea germination trial. List its progress stages and final result.",
   );
 
-  assertToolCalls(response, [{
+  await assertToolCallsWithOptionalFeedback(response, [{
     name: "run-germination-trial",
     arguments: { tray: "sample-tray" },
   }]);
@@ -34,4 +42,5 @@ test("keeps progress stages distinct from the completed result", async (t) => {
   );
   assertNoToolCalls(followUp);
   assertResponseContains(followUp, "sow");
+  assertNoNegativeFeedback(response, followUp);
 });

package/initializer-dist/template/package.json

@@ -14,7 +14,9 @@
     "lint": "oxlint src test eval"
   },
   "devDependencies": {
-    "@emseepea/testing": "0.6.1",
+    "@emseepea/feedback": "0.2.1",
+    "@emseepea/testing": "0.9.4",
+    "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"
@@ -24,7 +26,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.4.0",
+    "@emseepea/server": "0.7.0",
     "zod": "4.4.3"
   }
 }

package/initializer-dist/template/test/server.test.mjs

@@ -1,6 +1,10 @@
 import assert from "node:assert/strict";
+import { once } from "node:events";
+import { createServer, request } from "node:http";
 import test from "node:test";
 
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { serveEmseepea } from "@emseepea/server";
 import {
   insecureTestAuthentication,
   startEmseepea,
@@ -44,10 +48,127 @@ test("the same template composes protected access and observability", async (t)
     observability: [{ id: "test-log", emit: (event) => events.push(event) }],
   }));
   const client = await running.connect("test-token");
-  const result = await client.callTool({
-    name: "run-germination-trial",
-    arguments: { tray: "sample-tray" },
-  });
+  const progress = [];
+  const result = await client.callTool(
+    { name: "run-germination-trial", arguments: { tray: "sample-tray" } },
+    { onprogress: (update) => progress.push(update) },
+  );
+  assert.deepEqual(progress.map(({ message }) => message), ["soak", "sow", "sprout"]);
   assert.equal(result.structuredContent.status, "complete");
   assert.ok(events.some(({ capability }) => capability === "run-germination-trial"));
 });
+
+test("protected progress crosses a trusted proxy through official and raw clients", async (t) => {
+  const permissions = ["trials:run"];
+  const backend = await serveEmseepea(await createProgressStreamingServer({
+    access: { access: "protected", requiredScopes: permissions },
+    authentication: insecureTestAuthentication(permissions, "public"),
+    deployment: {
+      mode: "production-behind-proxy",
+      trustedProxyAddresses: ["127.0.0.1"],
+      allowedAuthorities: ["test.example"],
+      allowedOrigins: ["https://test.example"],
+      rateLimit: { maxRequests: 20, windowMs: 1_000, maxClients: 1 },
+    },
+  }), { port: 0 });
+  const proxy = await startTrustedProxy(backend.url);
+  t.after(async () => {
+    proxy.closeAllConnections();
+    await new Promise((resolve) => proxy.close(resolve));
+    await backend.close();
+  });
+  const url = new URL(`http://127.0.0.1:${proxy.address().port}/mcp`);
+
+  const client = new Client(
+    { name: "packed-progress-test", version: "0.0.0" },
+    { versionNegotiation: { mode: { pin: "2026-07-28" } } },
+  );
+  try {
+    await client.connect(new StreamableHTTPClientTransport(url, {
+      requestInit: { headers: {
+        Accept: "application/json, text/event-stream",
+        Authorization: "Bearer official-token",
+      } },
+    }));
+    const progress = [];
+    const result = await client.callTool(
+      { name: "run-germination-trial", arguments: { tray: "sample-tray" } },
+      { onprogress: (update) => progress.push(update) },
+    );
+    assert.ok(proxy.requestBodies.some((body) => body.includes('"progressToken"')));
+    assert.equal(proxy.responseTypes.at(-1), "text/event-stream");
+    assert.deepEqual(progress.map(({ message }) => message), ["soak", "sow", "sprout"]);
+    assert.equal(result.structuredContent.tray, "sample-tray");
+  } finally {
+    await client.close();
+  }
+
+  const response = await fetch(url, rawCall("raw-token"));
+  assert.equal(response.status, 200);
+  assert.match(response.headers.get("content-type"), /^text\/event-stream/);
+  const messages = (await response.text()).trim().split("\n\n").map((frame) =>
+    JSON.parse(frame.slice(frame.indexOf("data: ") + 6)));
+  assert.deepEqual(messages.slice(0, -1).map(({ params }) => params.message), ["soak", "sow", "sprout"]);
+  assert.equal(messages.at(-1).result.structuredContent.tray, "sample-tray");
+  assert.doesNotMatch(JSON.stringify(messages), /raw-token/);
+});
+
+async function startTrustedProxy(backendUrl) {
+  const requestBodies = [];
+  const responseTypes = [];
+  const proxy = createServer((incoming, outgoing) => {
+    const chunks = [];
+    incoming.on("data", (chunk) => chunks.push(chunk));
+    incoming.on("end", () => requestBodies.push(Buffer.concat(chunks).toString("utf8")));
+    const upstream = request(new URL(incoming.url, backendUrl), {
+      method: incoming.method,
+      headers: {
+        ...incoming.headers,
+        host: "test.example",
+        "x-forwarded-for": "192.0.2.1",
+        "x-forwarded-proto": "https",
+      },
+    });
+    upstream.on("response", (response) => {
+      responseTypes.push(response.headers["content-type"]);
+      outgoing.writeHead(response.statusCode, response.headers);
+      response.pipe(outgoing);
+    });
+    upstream.on("error", () => outgoing.destroy());
+    incoming.pipe(upstream);
+  });
+  proxy.listen(0, "127.0.0.1");
+  await once(proxy, "listening");
+  proxy.requestBodies = requestBodies;
+  proxy.responseTypes = responseTypes;
+  return proxy;
+}
+
+function rawCall(token) {
+  return {
+    method: "POST",
+    headers: {
+      Accept: "application/json, text/event-stream",
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      "MCP-Protocol-Version": "2026-07-28",
+      "Mcp-Method": "tools/call",
+      "Mcp-Name": "run-germination-trial",
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: "raw-call",
+      method: "tools/call",
+      params: {
+        name: "run-germination-trial",
+        arguments: { tray: "sample-tray" },
+        _meta: {
+          "io.modelcontextprotocol/protocolVersion": "2026-07-28",
+          "io.modelcontextprotocol/clientInfo": { name: "raw-progress-test", version: "0.0.0" },
+          "io.modelcontextprotocol/clientCapabilities": {},
+          progressToken: "raw-progress",
+        },
+      },
+    }),
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emseepea/create-progress-streaming-server",
-  "version": "0.0.14",
+  "version": "0.0.19",
   "description": "Create an Em See Pea server that streams tool progress.",
   "license": "MIT",
   "type": "module",
@@ -18,9 +18,11 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/server": "0.4.0",
+    "@emseepea/feedback": "0.2.1",
+    "@emseepea/server": "0.7.0",
     "zod": "4.4.3",
-    "@emseepea/testing": "0.6.1",
+    "@emseepea/testing": "0.9.4",
+    "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"