@gemus/mcp-proxy 0.1.8 → 0.1.10

package/src/__tests__/fixtures/proxy-runtime-loader.mjs

@@ -1,136 +0,0 @@
-function moduleUrl(source) {
-  return `data:text/javascript,${encodeURIComponent(source)}`
-}
-
-const markerPrelude = `
-  import fs from 'node:fs'
-  function mark(name) {
-    const file = process.env.PROXY_TEST_CONSTRUCTION_LOG
-    if (file) fs.appendFileSync(file, name + '\\n')
-  }
-`
-
-const modules = new Map([
-  ['@gemus/codex-backfill-core', `
-    export const CLIENT_CAPABILITIES = []
-    export const CLIENT_CAPABILITIES_HEADER = 'X-Gemus-Client-Capabilities'
-    export function serializeClientCapabilities(value) { return JSON.stringify(value) }
-    export function unwrapMcpContent(value) { return value }
-  `],
-  ['@modelcontextprotocol/sdk/server/stdio.js', `
-    ${markerPrelude}
-    export class StdioServerTransport {
-      constructor() { mark('stdio-transport') }
-      async start() {
-        if (process.env.PROXY_TEST_STDIO_START_FAILURE === '1') {
-          this.onclose?.()
-          throw new Error(
-            'stdio failed Authorization: Bearer '
-            + process.env.GEMUS_KEY
-            + ' at '
-            + process.env.GEMUS_URL
-          )
-        }
-        if (process.env.PROXY_TEST_FORWARD_STDIN === '1') {
-          let input = ''
-          process.stdin.setEncoding('utf8')
-          process.stdin.on('data', (chunk) => {
-            input += chunk
-            for (;;) {
-              const newline = input.indexOf('\\n')
-              if (newline < 0) break
-              const line = input.slice(0, newline).trim()
-              input = input.slice(newline + 1)
-              if (line) this.onmessage?.(JSON.parse(line))
-            }
-          })
-        }
-        process.stdin.resume()
-        process.stdin.once('end', () => this.onclose?.())
-      }
-      async send() {}
-    }
-  `],
-  ['@modelcontextprotocol/sdk/client/streamableHttp.js', `
-    ${markerPrelude}
-    export class StreamableHTTPClientTransport {
-      constructor() { mark('upstream-transport') }
-      async start() {}
-      async send(message) {
-        if (
-          process.env.PROXY_TEST_UPSTREAM_INITIALIZE_FAILURE === '1'
-          && message?.method === 'initialize'
-        ) {
-          throw new Error(
-            'initialize fetch failed Authorization: Bearer '
-            + process.env.GEMUS_KEY
-            + ' at '
-            + process.env.GEMUS_URL
-          )
-        }
-      }
-      async terminateSession() {}
-      async close() {}
-    }
-  `],
-  ['node:http', `
-    ${markerPrelude}
-    function hookError() {
-      return new Error(
-        'hook listen failed Authorization: Bearer '
-        + process.env.GEMUS_KEY
-        + ' at '
-        + process.env.GEMUS_URL
-      )
-    }
-    const http = {
-      createServer() {
-        mark('hook-server')
-        const listeners = new Map()
-        return {
-          on(event, handler) { listeners.set(event, handler); return this },
-          listen(_port, _host, callback) {
-            if (process.env.PROXY_TEST_HOOK_LISTEN_FAILURE === '1') {
-              queueMicrotask(() => listeners.get('error')?.(hookError()))
-            } else {
-              queueMicrotask(callback)
-            }
-            return this
-          },
-          address() { return { port: 43114 } },
-          unref() {},
-          close() {
-            mark('hook-server-close')
-            if (process.env.PROXY_TEST_HOOK_ERROR_AFTER_CLOSE === '1') {
-              queueMicrotask(() => listeners.get('error')?.(hookError()))
-            }
-          },
-        }
-      },
-    }
-    export default http
-  `],
-  ['./backfill.mjs', `
-    ${markerPrelude}
-    export function createBackfiller() {
-      mark('backfiller')
-      return {
-        observeCall() {},
-        observeResult() {},
-        async backfillTurn() {},
-      }
-    }
-    export function injectSteering() { return false }
-  `],
-])
-
-export async function resolve(specifier, context, nextResolve) {
-  const source = modules.get(specifier)
-  if (
-    source !== undefined
-    && (specifier !== './backfill.mjs' || context.parentURL?.endsWith('/proxy.mjs'))
-  ) {
-    return { url: moduleUrl(source), shortCircuit: true }
-  }
-  return nextResolve(specifier, context)
-}

package/src/__tests__/mcpHeaders.test.ts

@@ -1,32 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { CLIENT_CAPABILITIES } from '@gemus/codex-backfill-core'
-import { buildProxyUpstreamHeaders } from '../mcpHeaders.mjs'
-
-describe('buildProxyUpstreamHeaders', () => {
-  it('advertises only the capabilities the proxy can actually fulfil', () => {
-    expect(buildProxyUpstreamHeaders('mak_test123')).toEqual({
-      Authorization: 'Bearer mak_test123',
-      'X-Gemus-Client-Capabilities': 'agent-authored-prompts,codex-imagen',
-    })
-  })
-
-  it('never advertises codex-instant-delivery — the proxy has no ImageScheduler to renew the lease (#2049)', () => {
-    // 该能力门控服务端的 AWAITING_CLIENT execute 分支，要求客户端有 scheduler 每 60s renewLease。
-    // 只有 bridge 有（且 probe 门控，见 bridge/src/cli.ts）。proxy 没有 —— 发了它就等于承诺一个
-    // 永不到来的续租 → 5min 后 CLIENT_LEASE_EXPIRED → 图 orphan 成孤立 image-upload 节点。
-    // absent → 服务端回退经典两阶段 client-delivered 协议，proxy 完全支持（backfill.mjs）。
-    const header = buildProxyUpstreamHeaders('mak_test123')['X-Gemus-Client-Capabilities']
-    expect(header).not.toContain('codex-instant-delivery')
-  })
-
-  it('stays a strict subset of the shared allowlist — a new capability must not auto-inherit (#2049)', () => {
-    // 回归门：本 bug 的成因正是 proxy 发「整个 CLIENT_CAPABILITIES 数组」—— #1969 往数组里加了
-    // codex-instant-delivery，proxy 就自动继承了一个它做不到的承诺，而 #1990 把红掉的断言改成
-    // 迎合它。此断言让「加能力」与「proxy 声称支持它」变成两个独立决策，不再自动传染。
-    const advertised = buildProxyUpstreamHeaders('mak_test123')['X-Gemus-Client-Capabilities'].split(',')
-    for (const capability of advertised) {
-      expect(CLIENT_CAPABILITIES).toContain(capability)
-    }
-    expect(advertised.length).toBeLessThan(CLIENT_CAPABILITIES.length)
-  })
-})

package/src/__tests__/route.integration.test.ts

@@ -1,68 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { Client } from '@modelcontextprotocol/sdk/client/index.js'
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
-
-/**
- * Opt-in integration test against a REAL running gemus `/api/mcp` route (#1751). Validates the Mode-B
- * **key-only** contract the proxy + core delivery rely on: Bearer `mak_` auth with **no**
- * `X-Gemus-Session-Id` header, and addressing by an explicit real `workflowId`.
- *
- * Excluded from the default runner (`*.integration.test.ts`) and gated on env so it never runs in CI or
- * by accident. To run against local dev:
- *   GEMUS_IT_KEY=mak_... GEMUS_IT_WORKFLOW=<realWorkflowId> \
- *   pnpm exec vitest run packages/gemus-mcp-proxy/src/__tests__/route.integration.test.ts
- * (GEMUS_IT_URL defaults to http://localhost:3000/api/mcp.) All calls here are read-only (no mutation).
- *
- * connect-per-call invariant: every case opens + closes its own client (fresh connectionNonce, #1744).
- */
-const KEY = process.env.GEMUS_IT_KEY
-const URL_ = process.env.GEMUS_IT_URL || 'http://localhost:3000/api/mcp'
-const WORKFLOW = process.env.GEMUS_IT_WORKFLOW
-
-/** Key-only client: Bearer only, deliberately NO X-Gemus-Session-Id (the Mode-B contract). */
-async function connectKeyOnly() {
-  const client = new Client({ name: 'gemus-proxy-it', version: '0.1.0' })
-  const transport = new StreamableHTTPClientTransport(new URL(URL_), {
-    requestInit: { headers: { Authorization: `Bearer ${KEY}` } },
-  })
-  await client.connect(transport)
-  return client
-}
-
-describe.skipIf(!KEY)('key-only /api/mcp route (real, opt-in)', () => {
-  it('relays the full tool surface incl. execute/batch_execute (no session header)', async () => {
-    const client = await connectKeyOnly()
-    try {
-      const { tools } = await client.listTools()
-      const names = tools.map((t) => t.name)
-      expect(names).toEqual(expect.arrayContaining(['execute', 'batch_execute', 'canvas_read', 'canvas_edit']))
-    } finally {
-      await client.close()
-    }
-  })
-
-  it('serves resources (skills / knowledge) through the key-only connection', async () => {
-    const client = await connectKeyOnly()
-    try {
-      const { resources } = await client.listResources()
-      // The route exposes skill:// / knowledge:// resources; a tool-only passthrough would drop these.
-      expect(Array.isArray(resources)).toBe(true)
-    } finally {
-      await client.close()
-    }
-  })
-
-  it.skipIf(!WORKFLOW)('addresses a real workflow by explicit workflowId (key-only, no activeContext)', async () => {
-    const client = await connectKeyOnly()
-    try {
-      // canvas_read is read-only; success proves key-only addressing by explicit workflowId works
-      // without a session header (what deliverImageToNode relies on in Mode B).
-      const res = (await client.callTool({ name: 'canvas_read', arguments: { workflowId: WORKFLOW } })) as {
-        isError?: boolean
-      }
-      expect(res.isError).not.toBe(true)
-    } finally {
-      await client.close()
-    }
-  })
-})