@goliapkg/sentori-cli 1.8.0 → 1.9.0

package/src/__tests__/mcp.test.ts

@@ -3,16 +3,20 @@
 import { describe, expect, test } from 'bun:test'
 
 import { buildTools } from '../mcp.js'
+import { fileURLToPath } from 'node:url'
 
 describe('mcp tools', () => {
   const tools = buildTools()
 
-  test('exactly the four closed-loop tools exist', () => {
+  test('the closed loop includes durable watch', () => {
     expect(tools.map((t) => t.name).sort()).toEqual([
+      'sentori_issue_attachment',
       'sentori_issue_bundle',
       'sentori_issue_list',
       'sentori_issue_note',
+      'sentori_issue_read',
       'sentori_issue_resolve',
+      'sentori_issue_watch',
     ])
   })
 
@@ -30,3 +34,126 @@ describe('mcp tools', () => {
     }
   })
 })
+
+test('watch and evidence use the project API with credentials and lossless cursors', async () => {
+  const requests: { url: URL; auth: string | null }[] = []
+  const server = Bun.serve({
+    port: 0,
+    fetch(req) {
+      const url = new URL(req.url)
+      requests.push({ url, auth: req.headers.get('authorization') })
+      if (url.searchParams.get('format') === 'json') return Response.json({ schemaVersion: 1, evidence: { missing: ['stack'] } })
+      if (url.pathname.endsWith('/bundle')) return new Response('# Evidence')
+      return Response.json({ changes: [], nextCursor: 'v1:test:9223372036854775807', hasMore: false })
+    },
+  })
+  try {
+    const tools = buildTools()
+    const ctx = { apiUrl: server.url.toString(), token: 'test-only' }
+    const watch = tools.find((t) => t.name === 'sentori_issue_watch')!
+    const bundle = tools.find((t) => t.name === 'sentori_issue_bundle')!
+    const cursor = 'v1:test:9223372036854775807'
+    const result = await watch.handler({ cursor, limit: 17, waitSeconds: 25 }, ctx)
+    expect(result).toEqual({ changes: [], nextCursor: cursor, hasMore: false })
+    expect(requests[0].url.pathname).toBe('/api/issues/watch')
+    expect(requests[0].url.searchParams.get('cursor')).toBe(cursor)
+    expect(requests[0].url.searchParams.get('waitSeconds')).toBe('25')
+    expect(requests[0].auth).toBe('Bearer test-only')
+    await bundle.handler({ issueId: 'a/b', format: 'json' }, ctx)
+    expect(requests[1].url.pathname).toBe('/api/issues/a%2Fb/bundle')
+    expect(requests[1].url.searchParams.get('format')).toBe('json')
+    expect(await bundle.handler({ issueId: 'test' }, ctx)).toBe('# Evidence')
+    for (const args of [{ waitSeconds: 26 }, { limit: 0 }, { limit: 1.5 }]) {
+      await expect(watch.handler(args, ctx)).rejects.toThrow()
+    }
+    expect(requests).toHaveLength(3)
+  } finally { server.stop(true) }
+})
+
+test('stdio negotiates, stays responsive during watch, and separates protocol and tool errors', async () => {
+  const server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      if (new URL(req.url).pathname.endsWith('/attachments/test')) {
+        return new Response(Buffer.from('R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==', 'base64'), { headers: { 'Content-Type': 'image/gif' } })
+      }
+      if (new URL(req.url).pathname.endsWith('/watch')) {
+        await Bun.sleep(200)
+        return Response.json({ schemaVersion: 1, changes: [], nextCursor: 'v1:test:0', hasMore: false })
+      }
+      return Response.json({ error: 'database_unavailable' }, { status: 503 })
+    },
+  })
+  const source = fileURLToPath(new URL('../mcp.ts', import.meta.url))
+  const requests = [
+    { id: 0, method: 'initialize', params: { protocolVersion: '2025-11-25' } },
+    { id: 1, method: 'tools/call', params: { name: 'sentori_issue_watch', arguments: { waitSeconds: 1 } } },
+    { id: 2, method: 'ping' },
+    { id: 3, method: 'tools/call', params: { name: 'sentori_issue_list' } },
+    { id: 4, method: 'tools/call', params: { name: 'sentori_issue_watch', arguments: { waitSeconds: 26 } } },
+    { id: 5, method: 'unknown' },
+    { id: 6, method: 'tools/call', params: { name: 'missing' } },
+    { id: 7, method: 'tools/list' },
+    { id: 8, method: 'tools/call', params: { name: 'sentori_issue_attachment', arguments: { issueId: 'issue', attachmentRef: 'test' } } },
+  ].map((r) => JSON.stringify({ jsonrpc: '2.0', ...r })).join('\n') + '\nnull\n{broken\n'
+  try {
+    const child = Bun.spawn([process.execPath, '-e', `import {runMcpServer} from ${JSON.stringify(source)}; await runMcpServer({apiUrl: ${JSON.stringify(server.url.toString())}, token: 'test-only'})`], {
+      stdin: new Blob([requests]), stdout: 'pipe', stderr: 'pipe',
+    })
+    const output = await new Response(child.stdout).text()
+    expect(await child.exited).toBe(0)
+    const responses = output.trim().split('\n').map((line) => JSON.parse(line))
+    const byId = (id: number) => responses.find((r) => r.id === id)
+    expect(byId(0).result.protocolVersion).toBe('2025-11-25')
+    expect(byId(1).result.structuredContent.nextCursor).toBe('v1:test:0')
+    expect(responses.indexOf(byId(2))).toBeLessThan(responses.indexOf(byId(1)))
+    expect(byId(3).result.isError).toBe(true)
+    expect(byId(3).result.structuredContent.error).toEqual({ code: 'database_unavailable', status: 503, retryable: true })
+    expect(byId(4).result.isError).toBe(true)
+    expect(byId(5).error.code).toBe(-32601)
+    expect(byId(6).error.code).toBe(-32602)
+    expect(byId(7).result.tools.find((t: { name: string }) => t.name === 'sentori_issue_watch').annotations.readOnlyHint).toBe(true)
+    expect(byId(8).result.content[0]).toEqual({ type: 'image', mimeType: 'image/gif', data: 'R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==' })
+    expect(responses.filter((r) => r.id === null).map((r) => r.error.code)).toEqual([-32600, -32700])
+  } finally { server.stop(true) }
+})
+
+test('attachment reads are bounded even without Content-Length', async () => {
+  const server = Bun.serve({
+    port: 0,
+    fetch() {
+      return new Response(new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array(1024 * 1024))
+          controller.enqueue(new Uint8Array(1))
+          controller.close()
+        },
+      }), { headers: { 'Content-Type': 'text/plain' } })
+    },
+  })
+  try {
+    const tool = buildTools().find((t) => t.name === 'sentori_issue_attachment')!
+    await expect(tool.handler({ issueId: 'i', attachmentRef: 'r' }, { apiUrl: server.url.toString(), token: 'test-only' })).rejects.toThrow('1 MiB')
+  } finally { server.stop(true) }
+})
+
+test('a cancelled watch releases the request without blocking subsequent calls', async () => {
+  const server = Bun.serve({ port: 0, fetch: () => new Promise<Response>(() => {}) })
+  const source = fileURLToPath(new URL('../mcp.ts', import.meta.url))
+  const input = [
+    { id: 1, method: 'tools/call', params: { name: 'sentori_issue_watch', arguments: { waitSeconds: 25 } } },
+    { method: 'notifications/cancelled', params: { requestId: 1, reason: 'test cancellation' } },
+    { id: 2, method: 'ping' },
+  ].map((r) => JSON.stringify({ jsonrpc: '2.0', ...r })).join('\n') + '\n'
+  try {
+    const child = Bun.spawn([process.execPath, '-e', `import {runMcpServer} from ${JSON.stringify(source)}; await runMcpServer({apiUrl: ${JSON.stringify(server.url.toString())}, token: 'test-only'})`], {
+      stdin: new Blob([input]), stdout: 'pipe', stderr: 'pipe',
+    })
+    const output = await new Response(child.stdout).text()
+    expect(await child.exited).toBe(0)
+    const responses = output.trim().split('\n').map((line) => JSON.parse(line))
+    expect(responses).toHaveLength(2)
+    expect(responses.find((r) => r.id === 1).result.isError).toBe(true)
+    expect(responses.find((r) => r.id === 2).result).toEqual({})
+  } finally { server.stop(true) }
+})

package/src/__tests__/workflow.test.ts

@@ -42,7 +42,8 @@ describe('unified release upload', () => {
         const bytes = gunzipSync(Buffer.from(await file.arrayBuffer()))
         const kind = String(form.get('kind'))
         if (kind === 'srcbundle') expect(inspectSourceArchive(bytes, 'app@1+7').files).toEqual(['src/a.ts'])
-        uploaded.push({ kind, name: file.name.replace(/\.gz$/, ''), usable: true, contentHash: createHash('sha256').update(bytes).digest('hex') })
+        const contentHash = createHash('sha256').update(bytes).digest('hex')
+        uploaded.push({ kind, name: file.name.replace(/\.gz$/, ''), usable: true, contentHash, storageVerification: { integrity: 'verified', actualContentHash: contentHash, actualSizeBytes: bytes.length, usable: true } })
         return reply({ id: String(uploaded.length), usable: true }, 201)
       }
       return reply({ release: 'app@1+7', known: uploaded.length > 0, artifacts: uploaded,
@@ -135,3 +136,42 @@ test('matching project is verified before artifact compatibility and upload', as
   expect(calls[0]).toBe('https://upload.test/api/project')
   expect(calls).toHaveLength(2)
 })
+
+
+test('verification fails closed for stale metadata and corrupted or missing stored bytes', async () => {
+  writeFileSync(join(root, 'mapping.txt'), 'A -> a:\n')
+  const plan = prepareUploadPlan(config({ mapping: ['mapping.txt'] }))
+  const file = plan.files[0]!
+  const row = { kind: file.kind, name: file.name, contentHash: file.hash, usable: true }
+  for (const storageVerification of [undefined,
+    { integrity: 'mismatch', actualContentHash: file.hash, actualSizeBytes: 0, usable: true },
+    { integrity: 'unavailable' },
+    { integrity: 'verified', actualContentHash: 'wrong', actualSizeBytes: file.bytes, usable: true },
+  ]) {
+    globalThis.fetch = (async url => {
+      expect(String(url)).toEndWith('?verify=true')
+      return reply({ known: true, release: plan.release, artifacts: [{ ...row, storageVerification }] })
+    }) as typeof fetch
+    expect((await verifyUploadPlan(plan, 't'))[0]).toContain('stored bytes not verified')
+  }
+})
+
+
+test('strict upload preserves HTTP failure details even when verification also fails', async () => {
+  writeFileSync(join(root, 'mapping.txt'), 'A -> a:\n')
+  const path = config({ mapping: ['mapping.txt'] })
+  let posted = false
+  globalThis.fetch = (async (_url, init) => {
+    if (init?.method === 'POST') { posted = true; return reply({ error: 'upstream unavailable' }, 502) }
+    if (posted) return reply({ error: 'verification unavailable' }, 503)
+    return reply({ known: false, release: 'app@1+7', artifacts: [] })
+  }) as typeof fetch
+  const originalError = console.error, messages: string[] = []
+  console.error = (...args) => { messages.push(args.join(' ')) }
+  try { expect(await runWorkflow('upload', ['--config', path, '--strict'])).toBe(1) }
+  finally { console.error = originalError }
+  expect(messages.join('\n')).toContain('mapping.txt: 502')
+  expect(messages.join('\n')).toContain('upstream unavailable')
+  expect(messages.join('\n')).toContain('verification request failed: 503')
+  expect(messages.join('\n')).not.toContain('api-test')
+})

package/src/artifacts.ts

@@ -31,6 +31,7 @@ export type ArtifactRow = {
    *  the check existed — "never looked at", not "looked at and
    *  fine". `false` means it stored and will symbolicate nothing. */
   usable?: boolean | null
+  storageVerification?: { integrity: string; actualContentHash?: string; actualSizeBytes?: number; usable?: boolean | null }
 }
 
 export type ArtifactsResponse = {
@@ -55,10 +56,11 @@ export async function fetchArtifacts(opts: {
   apiUrl: string
   release: string
   token: string
+  verify?: boolean
 }): Promise<ArtifactsResponse> {
   const url =
     `${opts.apiUrl.replace(/\/+$/, '')}/v1/releases/` +
-    `${encodeURIComponent(opts.release)}/artifacts`
+    `${encodeURIComponent(opts.release)}/artifacts${opts.verify ? "?verify=true" : ""}`
   const resp = await fetch(url, {
     headers: { Authorization: `Bearer ${opts.token}` },
   })

package/src/compatibility.ts

@@ -9,7 +9,7 @@ export function checkCompatibility(result: ArtifactsResponse, sourceZip: boolean
   const info = result.compatibility
   if (info === undefined) {
     if (sourceZip) throw new Error('This server does not advertise source ZIP support. No files were uploaded. Upgrade the Sentori server to a build advertising artifact protocol 1 and sourceBundleFormats: ["zip"], then run sentori doctor. Existing CLI 1.5 pipelines may continue using legacy JSON sources.')
-    return 'Legacy artifact API: server capabilities are not advertised. Source maps, dSYM and mapping uploads remain available; verification still requires matching SHA-256 bytes and usable: true.'
+    return 'Legacy artifact API: server capabilities are not advertised. Source maps, dSYM and mapping uploads remain available; verification requires a server that supplies fresh storageVerification proof; inventory metadata alone cannot pass.'
   }
   if (!info || typeof info.serverVersion !== 'string' || info.artifactProtocol !== 1
     || !Array.isArray(info.sourceBundleFormats) || !Array.isArray(info.verification)

package/src/index.ts

@@ -8,7 +8,7 @@ import { listApps, showProject } from './apps.js'
 import {
   fetchBundle,
   formatIssueLine,
-  listIssues,
+  listIssuesPage,
   noteIssue,
   resolveIssue,
 } from './issue.js'
@@ -58,7 +58,7 @@ CI triage (the same /api surface an AI agent uses):
   sentori project show [--json]       project selected by the API token
   sentori app list [--json]           apps within that project
   sentori issue list [--status open] [--kind error] [--app <uuid>]
-      [--platform <platform>] [--environment <env>] [--release <release>] [--json]
+      [--platform <platform>] [--environment <env>] [--release <release>] [--limit 50] [--offset 0] [--json]
   sentori issue resolve <issue-id> [--in-release <r>]
   sentori issue note <issue-id> --body "fixed in abc123"
   sentori issue bundle <issue-id>
@@ -466,7 +466,7 @@ async function cmdIssueList(argv: string[]): Promise<number> {
   try {
     parsed = parseArgs({
       args: argv,
-      options: { ...ISSUE_OPTS, kind: { type: 'string' }, status: { type: 'string' }, app: { type: 'string' }, platform: { type: 'string' }, environment: { type: 'string' }, release: { type: 'string' }, json: { type: 'boolean' } },
+      options: { ...ISSUE_OPTS, kind: { type: 'string' }, status: { type: 'string' }, app: { type: 'string' }, platform: { type: 'string' }, environment: { type: 'string' }, release: { type: 'string' }, limit: { type: 'string' }, offset: { type: 'string' }, json: { type: 'boolean' } },
     })
   } catch (e) {
     console.error(`error: ${(e as Error).message}\n${HELP}`)
@@ -479,15 +479,18 @@ async function cmdIssueList(argv: string[]): Promise<number> {
   const cfg = parseApiCfg(parsed.values)
   if (!cfg) return 2
   try {
-    const rows = await listIssues(cfg, {
+    const page = await listIssuesPage(cfg, {
       kind: parsed.values.kind as string | undefined,
       status: (parsed.values.status as string | undefined) ?? 'open',
       app: parsed.values.app,
       platform: parsed.values.platform,
       environment: parsed.values.environment,
       release: parsed.values.release,
+      limit: parsed.values.limit === undefined ? undefined : Number(parsed.values.limit),
+      offset: parsed.values.offset === undefined ? undefined : Number(parsed.values.offset),
     })
-    if (parsed.values.json) { console.log(JSON.stringify({ issues: rows }, null, 2)); return 0 }
+    if (parsed.values.json) { console.log(JSON.stringify(page, null, 2)); return 0 }
+    const rows = page.issues
     if (rows.length === 0) {
       console.log('(no matching issues)')
       return 0

package/src/issue.ts

@@ -37,10 +37,19 @@ async function apiFetch<T>(c: ApiConfig, path: string, init?: RequestInit): Prom
   return (await resp.json()) as T
 }
 
-export async function listIssues(
+export type IssueListOptions = { status?: string; kind?: string; app?: string; platform?: string; environment?: string; release?: string; limit?: number; offset?: number }
+export type IssuePage = { issues: Issue[]; total?: number; limit?: number; offset?: number; nextOffset?: number | null }
+
+export async function listIssues(c: ApiConfig, opts: IssueListOptions = {}): Promise<Issue[]> {
+  return (await listIssuesPage(c, opts)).issues
+}
+
+export async function listIssuesPage(
   c: ApiConfig,
-  opts: { status?: string; kind?: string; app?: string; platform?: string; environment?: string; release?: string } = {},
-): Promise<Issue[]> {
+  opts: IssueListOptions = {},
+): Promise<IssuePage> {
+  if (opts.limit !== undefined && (!Number.isSafeInteger(opts.limit) || opts.limit < 1 || opts.limit > 200)) throw new Error('--limit must be an integer from 1 to 200')
+  if (opts.offset !== undefined && (!Number.isSafeInteger(opts.offset) || opts.offset < 0)) throw new Error('--offset must be a non-negative safe integer')
   const q = new URLSearchParams()
   if (opts.status) q.set('status', opts.status)
   if (opts.kind) q.set('kind', opts.kind)
@@ -48,9 +57,11 @@ export async function listIssues(
   if (opts.platform) q.set('platform', opts.platform)
   if (opts.environment) q.set('environment', opts.environment)
   if (opts.release) q.set('release', opts.release)
+  if (opts.limit !== undefined) q.set('limit', String(opts.limit))
+  if (opts.offset !== undefined) q.set('offset', String(opts.offset))
   const qs = q.toString()
-  const body = await apiFetch<{ issues: Issue[] }>(c, `/api/issues${qs ? `?${qs}` : ''}`)
-  return body.issues
+  const body = await apiFetch<IssuePage>(c, `/api/issues${qs ? `?${qs}` : ''}`)
+  return body
 }
 
 export async function resolveIssue(