@hubium/hubium-mcp 0.1.0

package/dist/server.tools.test.js

@@ -0,0 +1,991 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { ContextManager } from './context/contextManager.js';
+import { buildToolHandlers, LocalRateLimiter } from './server.js';
+import { HubiumClientError } from '@hubium/client';
+const originalEnv = { ...process.env };
+let tempDir = '';
+beforeEach(async () => {
+    tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hubium-mcp-tools-'));
+    process.env = { ...originalEnv, HUBIUM_MCP_CONFIG_DIR: tempDir };
+});
+afterEach(async () => {
+    process.env = { ...originalEnv };
+    if (tempDir) {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    }
+});
+function parseResult(result) {
+    return JSON.parse(result.content[0].text);
+}
+function createHandlers(options) {
+    const manager = new ContextManager({ baseDir: tempDir });
+    const token = options?.token ?? null;
+    let followupToken = null;
+    const tokenStore = {
+        getToken: async () => (token ? { token, source: 'keychain' } : null),
+        getFollowupToken: () => followupToken,
+        setFollowupToken: (value) => {
+            followupToken = value;
+        },
+        clearFollowupToken: () => {
+            followupToken = null;
+        },
+    };
+    const whoamiResponse = options?.whoamiResponse ?? { actor: { id: 'agent-1' } };
+    const searchResponse = options?.searchResponse ?? {
+        items: [],
+        total: 0,
+        limit: 10,
+        offset: 0,
+        next_offset: null,
+        has_more: false,
+    };
+    const searchError = options?.searchError ?? null;
+    const getCaseResponse = options?.getCaseResponse ?? { case: { id: 1 } };
+    const getCaseError = options?.getCaseError ?? null;
+    const createCaseResponse = options?.createCaseResponse ?? {
+        case: { id: 1 },
+        audit_id: 'audit',
+    };
+    const createCaseError = options?.createCaseError ?? null;
+    const feedbackResponse = options?.feedbackResponse ?? {
+        feedback: { id: 1 },
+        audit_id: 'audit',
+    };
+    const feedbackError = options?.feedbackError ?? null;
+    let lastSearchParams = null;
+    let lastSearchOptions = null;
+    let lastGetCase = null;
+    let lastCreateCase = null;
+    let lastFeedback = null;
+    let lastClientToken = undefined;
+    const hubiumClientFactory = (input) => {
+        lastClientToken = input.token;
+        return ({
+            whoami: async () => whoamiResponse,
+            search: async (params, options) => {
+                lastSearchParams = params;
+                lastSearchOptions = options ?? null;
+                if (searchError) {
+                    throw searchError;
+                }
+                return searchResponse;
+            },
+            getCase: async (caseId, options) => {
+                lastGetCase = { caseId, options };
+                if (getCaseError) {
+                    throw getCaseError;
+                }
+                return getCaseResponse;
+            },
+            createCase: async (payload, options) => {
+                lastCreateCase = { payload, options };
+                if (createCaseError) {
+                    throw createCaseError;
+                }
+                return createCaseResponse;
+            },
+            addFeedback: async (caseId, payload, options) => {
+                lastFeedback = { caseId, payload, options };
+                if (feedbackError) {
+                    throw feedbackError;
+                }
+                return feedbackResponse;
+            },
+        });
+    };
+    const handlers = buildToolHandlers({
+        contextManager: manager,
+        tokenStore,
+        hubiumClientFactory,
+        safeMode: options?.safeMode ?? false,
+        rateLimiter: options?.rateLimiter ?? new LocalRateLimiter(1000, 60_000),
+        fetchImpl: options?.fetchImpl,
+    });
+    return {
+        handlers,
+        manager,
+        tokenStore,
+        getLastSearchParams: () => lastSearchParams,
+        getLastSearchOptions: () => lastSearchOptions,
+        getLastGetCase: () => lastGetCase,
+        getLastCreateCase: () => lastCreateCase,
+        getLastFeedback: () => lastFeedback,
+        getLastClientToken: () => lastClientToken,
+    };
+}
+describe('MCP tools', () => {
+    it('hubium.get_context returns defaults when file missing', async () => {
+        const { handlers } = createHandlers();
+        const result = await handlers.callTool({ params: { name: 'hubium.get_context' } });
+        const data = parseResult(result);
+        expect(data.context.version).toBe(1);
+    });
+    it('hubium.doctor returns structured diagnostics and never prints token', async () => {
+        const mockFetch = vi.fn().mockRejectedValue(new Error('ENOTFOUND'));
+        const { handlers } = createHandlers({
+            token: 'secret-token-xyz',
+            fetchImpl: mockFetch,
+        });
+        const result = await handlers.callTool({ params: { name: 'hubium.doctor', arguments: {} } });
+        const data = parseResult(result);
+        expect(data).toHaveProperty('ok');
+        expect(data).toHaveProperty('checks');
+        expect(data).toHaveProperty('resolved');
+        expect(data).toHaveProperty('auth');
+        expect(data).toHaveProperty('backend');
+        expect(data).toHaveProperty('next_steps');
+        expect(data).toHaveProperty('summary');
+        const json = JSON.stringify(data);
+        expect(json).not.toContain('secret-token');
+        expect(json).not.toContain('xyz');
+        expect(data.next_steps.length).toBeGreaterThan(0);
+    });
+    it('hubium.set_context persists base_url and workspace_ids', async () => {
+        const { handlers } = createHandlers();
+        await handlers.callTool({
+            params: {
+                name: 'hubium.set_context',
+                arguments: { base_url: 'https://hubium.dev', workspace_ids: ['w1', 'w2'] },
+            },
+        });
+        const result = await handlers.callTool({ params: { name: 'hubium.get_context' } });
+        const data = parseResult(result);
+        expect(data.context.base_url).toBe('https://hubium.dev');
+        expect(data.context.workspace_ids).toEqual(['w1', 'w2']);
+    });
+    it('mutual exclusivity enforced in hubium.set_context', async () => {
+        const { handlers } = createHandlers();
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.set_context',
+                arguments: { workspace_id: 'w1', workspace_ids: ['w2'] },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('Provide only one of workspace_id or workspace_ids');
+    });
+    it('enforces https unless allow_insecure_http is true', async () => {
+        const { handlers } = createHandlers();
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.set_context',
+                arguments: { base_url: 'http://hubium.dev' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('base_url must be https://');
+        const ok = await handlers.callTool({
+            params: {
+                name: 'hubium.set_context',
+                arguments: { base_url: 'http://hubium.dev', allow_insecure_http: true },
+            },
+        });
+        const okData = parseResult(ok);
+        expect(okData.context?.base_url).toBe('http://hubium.dev');
+    });
+    it('hubium.clear_context removes file and returns ok', async () => {
+        const { handlers } = createHandlers();
+        await handlers.callTool({
+            params: { name: 'hubium.set_context', arguments: { base_url: 'https://hubium.dev' } },
+        });
+        const cleared = await handlers.callTool({ params: { name: 'hubium.clear_context' } });
+        expect(parseResult(cleared)).toEqual({ ok: true });
+        const result = await handlers.callTool({ params: { name: 'hubium.get_context' } });
+        const data = parseResult(result);
+        expect(data.context.base_url).toBeUndefined();
+    });
+    it('tool output never includes token env values', async () => {
+        process.env.HUBIUM_TOKEN = 'secret';
+        const { handlers } = createHandlers();
+        const result = await handlers.callTool({ params: { name: 'hubium.get_context' } });
+        const output = result.content[0].text;
+        expect(output).not.toContain('secret');
+    });
+    it('hubium.whoami returns missing_base_url when unresolved', async () => {
+        const prev = { ...process.env };
+        try {
+            delete process.env.HUBIUM_BASE_URL;
+            delete process.env.HUBIUM_API_BASE_URL;
+            const { handlers } = createHandlers({ token: 'token' });
+            const result = await handlers.callTool({ params: { name: 'hubium.whoami' } });
+            const data = parseResult(result);
+            expect(data.ok).toBe(false);
+            expect(data.error).toBe('missing_base_url');
+        }
+        finally {
+            process.env = prev;
+        }
+    });
+    it('hubium.whoami returns missing_token when token unavailable', async () => {
+        const { handlers, manager } = createHandlers({ token: null });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({ params: { name: 'hubium.whoami' } });
+        const data = parseResult(result);
+        expect(data.ok).toBe(false);
+        expect(data.error).toBe('missing_token');
+    });
+    it('hubium.whoami returns actor and workspace defaults', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1', actor_type: 'agent' } },
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({ params: { name: 'hubium.whoami' } });
+        const data = parseResult(result);
+        expect(data.ok).toBe(true);
+        expect(data.actor).toEqual({ id: 'agent-1', actor_type: 'agent' });
+        expect(data.base_url).toBe('https://hubium.dev');
+        expect(data.workspace_defaults.workspace_id).toBe('w1');
+        expect(result.content[0].text).not.toContain('token');
+    });
+    it('hubium.search workspace precedence uses input over context', async () => {
+        const { handlers, manager, getLastSearchParams } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_ids: ['context'] });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.search',
+                arguments: { query: 'test', workspace_id: 'explicit' },
+            },
+        });
+        expect(getLastSearchParams()).toMatchObject({ workspace_id: 'explicit' });
+    });
+    it('hubium.search falls back to whoami when no context', async () => {
+        const { handlers, manager, getLastSearchParams } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test' } },
+        });
+        const data = parseResult(result);
+        expect(Array.isArray(data.items)).toBe(true);
+        expect(getLastSearchParams()).toMatchObject({ workspace_id: 'whoami' });
+    });
+    it('hubium.search uses context before whoami', async () => {
+        const { handlers, manager, getLastSearchParams } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test' } },
+        });
+        expect(getLastSearchParams()).toMatchObject({ workspace_id: 'context' });
+    });
+    it('hubium.search rejects both workspace_id and workspace_ids', async () => {
+        const { handlers } = createHandlers();
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.search',
+                arguments: { query: 'test', workspace_id: 'w1', workspace_ids: ['w2'] },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('Provide only one of workspace_id or workspace_ids');
+    });
+    it('hubium.search stores followup token in preview', async () => {
+        const { handlers, manager, tokenStore } = createHandlers({
+            searchResponse: {
+                items: [],
+                total: 0,
+                limit: 10,
+                offset: 0,
+                next_offset: null,
+                has_more: false,
+                access: {
+                    mode: 'preview',
+                    is_preview: true,
+                    auth_required_for_full: true,
+                    reason: 'ok',
+                },
+                search_session: {
+                    id: 'session-1',
+                    results_count: 0,
+                    results_hash: 'hash',
+                    results_changed: false,
+                    new_case_ids: [],
+                    removed_case_ids: [],
+                    followup_token: 'followup',
+                    is_followup: false,
+                    status: 'open',
+                    last_seen_at: null,
+                },
+            },
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test', mode: 'preview' } },
+        });
+        expect(tokenStore.getFollowupToken()).toBe('followup');
+    });
+    it('clears followup token on context set and clear', async () => {
+        const { handlers, tokenStore } = createHandlers();
+        tokenStore.setFollowupToken('followup');
+        await handlers.callTool({
+            params: { name: 'hubium.set_context', arguments: { base_url: 'https://hubium.dev' } },
+        });
+        expect(tokenStore.getFollowupToken()).toBeNull();
+        tokenStore.setFollowupToken('followup');
+        await handlers.callTool({ params: { name: 'hubium.clear_context' } });
+        expect(tokenStore.getFollowupToken()).toBeNull();
+    });
+    it('hubium.search does not leak secrets in errors', async () => {
+        const error = new HubiumClientError('oops SECRET_TOKEN', { kind: 'network' });
+        const { handlers, manager } = createHandlers({ token: 'SECRET_TOKEN', searchError: error });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test' } },
+        });
+        expect(result.content[0].text).not.toContain('SECRET_TOKEN');
+    });
+    it('hubium.search redacts env token in errors when tokenStore is empty (SEC-RED-01)', async () => {
+        const prev = { ...process.env };
+        try {
+            process.env.HUBIUM_TOKEN = 'SECRET_TOKEN';
+            const error = new HubiumClientError('oops SECRET_TOKEN', { kind: 'network' });
+            const { handlers, manager } = createHandlers({ token: null, searchError: error });
+            await manager.save({ base_url: 'https://hubium.dev' });
+            const result = await handlers.callTool({
+                params: { name: 'hubium.search', arguments: { query: 'test' } },
+            });
+            expect(result.content[0].text).not.toContain('SECRET_TOKEN');
+        }
+        finally {
+            process.env = prev;
+        }
+    });
+    it('hubium.search redacts HUBIUM_API_TOKEN in errors when tokenStore is empty (SEC-RED-02)', async () => {
+        const prev = { ...process.env };
+        try {
+            process.env.HUBIUM_API_TOKEN = 'SECRET_TOKEN';
+            const error = new HubiumClientError('oops SECRET_TOKEN', { kind: 'network' });
+            const { handlers, manager } = createHandlers({ token: null, searchError: error });
+            await manager.save({ base_url: 'https://hubium.dev' });
+            const result = await handlers.callTool({
+                params: { name: 'hubium.search', arguments: { query: 'test' } },
+            });
+            expect(result.content[0].text).not.toContain('SECRET_TOKEN');
+        }
+        finally {
+            process.env = prev;
+        }
+    });
+    it('hubium.search redacts followup token in errors (SEC-RED-03)', async () => {
+        const error = new HubiumClientError('oops FOLLOWUP_SECRET', { kind: 'network' });
+        const { handlers, manager, tokenStore } = createHandlers({
+            token: 'token',
+            searchError: error,
+        });
+        tokenStore.setFollowupToken('FOLLOWUP_SECRET');
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test' } },
+        });
+        expect(result.content[0].text).not.toContain('FOLLOWUP_SECRET');
+    });
+    it('hubium.get_case uses input workspace over context', async () => {
+        const { handlers, manager, getLastGetCase } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.get_case',
+                arguments: { case_id: '123', workspace_id: 'explicit' },
+            },
+        });
+        const last = getLastGetCase();
+        expect(last?.options).toMatchObject({ workspace_id: 'explicit' });
+    });
+    it('hubium.get_case uses context before whoami', async () => {
+        const { handlers, manager, getLastGetCase } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '123' } },
+        });
+        const last = getLastGetCase();
+        expect(last?.options).toMatchObject({ workspace_id: 'context' });
+    });
+    it('hubium.get_case falls back to whoami when no context', async () => {
+        const { handlers, manager, getLastGetCase } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '123' } },
+        });
+        const last = getLastGetCase();
+        expect(last?.options).toMatchObject({ workspace_id: 'whoami' });
+    });
+    it('hubium.get_case returns backend response', async () => {
+        const { handlers, manager } = createHandlers({
+            getCaseResponse: { case: { id: 42 }, access: { mode: 'full', is_preview: false, auth_required_for_full: false, reason: 'ok' } },
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '42' } },
+        });
+        const data = parseResult(result);
+        expect(data.case?.id).toBe(42);
+    });
+    it('hubium.get_case surfaces forbidden', async () => {
+        const { handlers, manager } = createHandlers({
+            getCaseError: new HubiumClientError('forbidden', { kind: 'http', status: 403 }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '42' } },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('hubium_client_error');
+        expect(data.status).toBe(403);
+    });
+    it('hubium.get_case surfaces not found', async () => {
+        const { handlers, manager } = createHandlers({
+            getCaseError: new HubiumClientError('not found', { kind: 'http', status: 404 }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '42' } },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('hubium_client_error');
+        expect(data.status).toBe(404);
+    });
+    it('hubium.get_case does not leak secrets in errors', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'SECRET_TOKEN',
+            getCaseError: new HubiumClientError('oops SECRET_TOKEN', { kind: 'network' }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '42' } },
+        });
+        expect(result.content[0].text).not.toContain('SECRET_TOKEN');
+    });
+    it('hubium.get_case redacts followup token in errors (SEC-RED-04)', async () => {
+        const error = new HubiumClientError('oops FOLLOWUP_SECRET', { kind: 'network' });
+        const { handlers, manager, tokenStore } = createHandlers({
+            token: 'token',
+            getCaseError: error,
+        });
+        tokenStore.setFollowupToken('FOLLOWUP_SECRET');
+        await manager.save({ base_url: 'https://hubium.dev' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '42' } },
+        });
+        expect(result.content[0].text).not.toContain('FOLLOWUP_SECRET');
+    });
+    it('hubium.create_case rejects missing visibility_intent', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: { name: 'hubium.create_case', arguments: { title: 'Title' } },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('visibility_intent is required');
+    });
+    it('hubium.create_case rejects missing token', async () => {
+        const { handlers, manager } = createHandlers({ token: null });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('missing_token');
+    });
+    it('hubium.create_case rejects workspace_ids input', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public', workspace_ids: ['w1'] },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('workspace_ids is not supported');
+    });
+    it('hubium.create_case rejects when context has workspace_ids', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_ids: ['w1', 'w2'] });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('missing_workspace');
+    });
+    it('hubium.create_case uses explicit workspace over context', async () => {
+        const { handlers, manager, getLastCreateCase } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public', workspace_id: 'explicit' },
+            },
+        });
+        expect(getLastCreateCase()?.payload).toMatchObject({ workspace_id: 'explicit' });
+    });
+    it('hubium.create_case uses context before whoami', async () => {
+        const { handlers, manager, getLastCreateCase } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public' },
+            },
+        });
+        expect(getLastCreateCase()?.payload).toMatchObject({ workspace_id: 'context' });
+    });
+    it('hubium.create_case falls back to whoami when no context', async () => {
+        const { handlers, manager, getLastCreateCase } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public' },
+            },
+        });
+        expect(getLastCreateCase()?.payload).toMatchObject({ workspace_id: 'whoami' });
+    });
+    it('hubium.create_case passes idempotency key', async () => {
+        const { handlers, manager, getLastCreateCase } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: {
+                    title: 'Title',
+                    visibility_intent: 'public',
+                    idempotency_key: 'idem',
+                },
+            },
+        });
+        expect(getLastCreateCase()?.options).toMatchObject({ idempotencyKey: 'idem' });
+    });
+    it('hubium.create_case surfaces forbidden', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'token',
+            createCaseError: new HubiumClientError('forbidden', { kind: 'http', status: 403 }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('hubium_client_error');
+        expect(data.status).toBe(403);
+    });
+    it('hubium.create_case does not leak idempotency key', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'token',
+            createCaseError: new HubiumClientError('oops IDEM', { kind: 'network' }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: {
+                    title: 'Title',
+                    visibility_intent: 'public',
+                    idempotency_key: 'IDEM',
+                },
+            },
+        });
+        expect(result.content[0].text).not.toContain('IDEM');
+    });
+    it('hubium.create_case redacts followup token in errors (SEC-RED-04)', async () => {
+        const error = new HubiumClientError('oops FOLLOWUP_SECRET', { kind: 'network' });
+        const { handlers, manager, tokenStore } = createHandlers({
+            token: 'token',
+            createCaseError: error,
+        });
+        tokenStore.setFollowupToken('FOLLOWUP_SECRET');
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: 'Title', visibility_intent: 'public' },
+            },
+        });
+        expect(result.content[0].text).not.toContain('FOLLOWUP_SECRET');
+    });
+    it('hubium.feedback rejects missing content', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: '   ' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('content is required');
+    });
+    it('hubium.feedback rejects missing feedback_type', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', content: 'ok' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('feedback_type is required');
+    });
+    it('hubium.feedback rejects missing token', async () => {
+        const { handlers, manager } = createHandlers({ token: null });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('missing_token');
+    });
+    it('hubium.feedback rejects workspace_ids input', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: {
+                    case_id: '1',
+                    feedback_type: 'comment',
+                    content: 'ok',
+                    workspace_ids: ['w1'],
+                },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('workspace_ids is not supported');
+    });
+    it('hubium.feedback rejects invalid visibility', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: {
+                    case_id: '1',
+                    feedback_type: 'comment',
+                    content: 'ok',
+                    visibility: 'external',
+                },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toContain('visibility must be one of');
+    });
+    it('hubium.feedback passes valid visibility through to client', async () => {
+        const { handlers, manager, getLastFeedback } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: {
+                    case_id: '1',
+                    feedback_type: 'comment',
+                    content: 'ok',
+                    visibility: 'public',
+                },
+            },
+        });
+        expect(getLastFeedback()?.payload).toMatchObject({ visibility: 'public' });
+    });
+    it('safe-mode blocks mutations and auth tools', async () => {
+        const { handlers, manager } = createHandlers({ safeMode: true, token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const createResult = await handlers.callTool({
+            params: { name: 'hubium.create_case', arguments: { title: 'Title', visibility_intent: 'public' } },
+        });
+        expect(parseResult(createResult)).toMatchObject({ error: 'safe_mode' });
+        const feedbackResult = await handlers.callTool({
+            params: { name: 'hubium.feedback', arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' } },
+        });
+        expect(parseResult(feedbackResult)).toMatchObject({ error: 'safe_mode' });
+        const whoamiResult = await handlers.callTool({ params: { name: 'hubium.whoami' } });
+        expect(parseResult(whoamiResult)).toMatchObject({ error: 'safe_mode' });
+    });
+    it('safe-mode forces preview and anonymous access', async () => {
+        const { handlers, manager, getLastSearchOptions, getLastSearchParams, getLastGetCase, tokenStore, getLastClientToken } = createHandlers({
+            safeMode: true,
+            token: 'token',
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        tokenStore.setFollowupToken('followup');
+        await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test', mode: 'full' } },
+        });
+        const options = getLastSearchOptions();
+        expect(options === null || options?.followupToken === undefined).toBe(true);
+        expect(getLastClientToken()).toBeUndefined();
+        expect(getLastSearchParams()).toMatchObject({ workspace_id: 'w1' });
+        await handlers.callTool({
+            params: { name: 'hubium.get_case', arguments: { case_id: '1' } },
+        });
+        expect(getLastGetCase()?.options).toMatchObject({ workspace_id: 'w1' });
+        expect(getLastClientToken()).toBeUndefined();
+    });
+    it('hubium.search passes followup token in full mode when available', async () => {
+        const { handlers, manager, tokenStore, getLastSearchOptions } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        tokenStore.setFollowupToken('followup');
+        await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test', mode: 'full' } },
+        });
+        expect(getLastSearchOptions()).toMatchObject({ followupToken: 'followup' });
+    });
+    it('hubium.create_case rejects oversized optional fields', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const basePayload = {
+            title: 'Title',
+            visibility_intent: 'public',
+        };
+        const longValue = 'x'.repeat(10001);
+        const fields = [
+            'description',
+            'final_solution',
+            'environment',
+            'steps_to_reproduce',
+            'expected',
+            'actual',
+        ];
+        for (const field of fields) {
+            const result = await handlers.callTool({
+                params: {
+                    name: 'hubium.create_case',
+                    arguments: { ...basePayload, [field]: longValue },
+                },
+            });
+            const data = parseResult(result);
+            expect(data.error).toBe(`${field} exceeds max length 10000`);
+        }
+    });
+    it('rate limiter blocks after threshold', async () => {
+        const limiter = new LocalRateLimiter(1, 60_000);
+        const { handlers, manager } = createHandlers({ rateLimiter: limiter });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test' } },
+        });
+        const second = await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: 'test' } },
+        });
+        const data = parseResult(second);
+        expect(data.error).toBe('rate_limited');
+        expect(typeof data.retry_after_ms).toBe('number');
+    });
+    it('payload caps reject oversized inputs', async () => {
+        const { handlers, manager } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const longQuery = 'q'.repeat(2001);
+        const searchResult = await handlers.callTool({
+            params: { name: 'hubium.search', arguments: { query: longQuery } },
+        });
+        expect(parseResult(searchResult)).toMatchObject({ error: 'query exceeds max length 2000' });
+        const longTitle = 't'.repeat(201);
+        const createResult = await handlers.callTool({
+            params: {
+                name: 'hubium.create_case',
+                arguments: { title: longTitle, visibility_intent: 'public' },
+            },
+        });
+        expect(parseResult(createResult)).toMatchObject({ error: 'title exceeds max length 200' });
+        const longContent = 'c'.repeat(10001);
+        const feedbackResult = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: longContent },
+            },
+        });
+        expect(parseResult(feedbackResult)).toMatchObject({ error: 'content exceeds max length 10000' });
+    });
+    it('hubium.feedback uses explicit workspace over context', async () => {
+        const { handlers, manager, getLastFeedback } = createHandlers({ token: 'token' });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: {
+                    case_id: '1',
+                    feedback_type: 'comment',
+                    content: 'ok',
+                    workspace_id: 'explicit',
+                },
+            },
+        });
+        expect(getLastFeedback()?.payload).toMatchObject({ workspace_id: 'explicit' });
+    });
+    it('hubium.feedback uses context before whoami', async () => {
+        const { handlers, manager, getLastFeedback } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'context' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' },
+            },
+        });
+        expect(getLastFeedback()?.payload).toMatchObject({ workspace_id: 'context' });
+    });
+    it('hubium.feedback falls back to whoami when no context', async () => {
+        const { handlers, manager, getLastFeedback } = createHandlers({
+            token: 'token',
+            whoamiResponse: { actor: { id: 'agent-1' }, workspaces: [{ id: 'whoami' }] },
+        });
+        await manager.save({ base_url: 'https://hubium.dev' });
+        await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' },
+            },
+        });
+        expect(getLastFeedback()?.payload).toMatchObject({ workspace_id: 'whoami' });
+    });
+    it('hubium.feedback returns backend response', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'token',
+            feedbackResponse: { feedback: { id: 2 }, audit_id: 'audit' },
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.feedback?.id).toBe(2);
+    });
+    it('hubium.feedback surfaces forbidden', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'token',
+            feedbackError: new HubiumClientError('forbidden', { kind: 'http', status: 403 }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' },
+            },
+        });
+        const data = parseResult(result);
+        expect(data.error).toBe('hubium_client_error');
+        expect(data.status).toBe(403);
+    });
+    it('hubium.feedback does not leak idempotency key', async () => {
+        const { handlers, manager } = createHandlers({
+            token: 'token',
+            feedbackError: new HubiumClientError('oops IDEM', { kind: 'network' }),
+        });
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: {
+                    case_id: '1',
+                    feedback_type: 'comment',
+                    content: 'ok',
+                    idempotency_key: 'IDEM',
+                },
+            },
+        });
+        expect(result.content[0].text).not.toContain('IDEM');
+    });
+    it('hubium.feedback redacts followup token in errors (SEC-RED-04)', async () => {
+        const error = new HubiumClientError('oops FOLLOWUP_SECRET', { kind: 'network' });
+        const { handlers, manager, tokenStore } = createHandlers({
+            token: 'token',
+            feedbackError: error,
+        });
+        tokenStore.setFollowupToken('FOLLOWUP_SECRET');
+        await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+        const result = await handlers.callTool({
+            params: {
+                name: 'hubium.feedback',
+                arguments: { case_id: '1', feedback_type: 'comment', content: 'ok' },
+            },
+        });
+        expect(result.content[0].text).not.toContain('FOLLOWUP_SECRET');
+    });
+    it('OPS-T01: structured stderr logs, redaction, request_id in tool error output', async () => {
+        const prev = { ...process.env };
+        try {
+            process.env.HUBIUM_TOKEN = 'SECRET_TOKEN';
+            const error = new HubiumClientError('oops SECRET_TOKEN FOLLOWUP_SECRET IDEM', {
+                kind: 'network',
+                requestId: 'rid_123',
+            });
+            const { handlers, manager, tokenStore } = createHandlers({
+                token: 'SECRET_TOKEN',
+                feedbackError: error,
+            });
+            tokenStore.setFollowupToken('FOLLOWUP_SECRET');
+            await manager.save({ base_url: 'https://hubium.dev', workspace_id: 'w1' });
+            let stderr = '';
+            const originalWrite = process.stderr.write.bind(process.stderr);
+            process.stderr.write = ((chunk, ...args) => {
+                stderr += String(chunk);
+                return originalWrite(chunk, ...args);
+            });
+            const result = await handlers.callTool({
+                params: {
+                    name: 'hubium.feedback',
+                    arguments: {
+                        case_id: '1',
+                        feedback_type: 'comment',
+                        content: 'ok',
+                        idempotency_key: 'IDEM',
+                    },
+                },
+            });
+            process.stderr.write = originalWrite;
+            expect(stderr).toContain('local_request_id');
+            expect(stderr).toContain('duration_ms');
+            expect(stderr).toContain('backend_request_id');
+            expect(stderr).toContain('rid_123');
+            expect(stderr).not.toContain('SECRET_TOKEN');
+            expect(stderr).not.toContain('FOLLOWUP_SECRET');
+            expect(stderr).not.toContain('IDEM');
+            const parsed = parseResult(result);
+            expect(parsed.error).toBe('hubium_client_error');
+            expect(parsed.requestId ?? parsed.request_id).toBe('rid_123');
+            expect(result.content[0].text).not.toContain('SECRET_TOKEN');
+            expect(result.content[0].text).not.toContain('FOLLOWUP_SECRET');
+            expect(result.content[0].text).not.toContain('IDEM');
+        }
+        finally {
+            process.env = prev;
+        }
+    });
+});
+//# sourceMappingURL=server.tools.test.js.map