@imgly/codesign-mcp 0.1.5 → 0.1.7

package/dist/test/test/gateway/local.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"local.test.d.ts","sourceRoot":"","sources":["../../../../test/gateway/local.test.ts"],"names":[],"mappings":""}

package/dist/test/test/gateway/local.test.js

@@ -1,29 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { LocalGatewayClient } from '../../src/gateway/local.js';
-describe('LocalGatewayClient', () => {
-    it('throws GatewayDisabledError when no API_KEY is configured', async () => {
-        const client = new LocalGatewayClient({ apiKey: undefined });
-        await expect(client.generateImage({ prompt: 'a cat' })).rejects.toMatchObject({ name: 'GatewayDisabledError' });
-    });
-    it('calls the configured endpoint with the API key and returns bytes', async () => {
-        const fetch = async (url, init) => {
-            const headers = init?.headers;
-            expect(url).toBe('https://gateway.example/v1/images/generate');
-            expect(headers.Authorization).toBe('Bearer test-key');
-            const body = JSON.parse(init?.body);
-            expect(body).toMatchObject({ prompt: 'a cat' });
-            return new Response(new Uint8Array([1, 2, 3, 4]), {
-                headers: { 'content-type': 'image/png' }
-            });
-        };
-        const client = new LocalGatewayClient({
-            apiKey: 'test-key',
-            endpoint: 'https://gateway.example/v1/images/generate',
-            fetch: fetch
-        });
-        const out = await client.generateImage({ prompt: 'a cat' });
-        expect(out.mimeType).toBe('image/png');
-        expect(Array.from(out.bytes)).toEqual([1, 2, 3, 4]);
-    });
-});
-//# sourceMappingURL=local.test.js.map

package/dist/test/test/gateway/local.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"local.test.js","sourceRoot":"","sources":["../../../../test/gateway/local.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,CACV,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAC1C,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,IAAkB,EAAE,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAiC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC/D,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAc,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;gBAChD,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;aACzC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC;YACpC,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,4CAA4C;YACtD,KAAK,EAAE,KAAgC;SACxC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from 'vitest';\nimport { LocalGatewayClient } from '../../src/gateway/local.js';\n\ndescribe('LocalGatewayClient', () => {\n  it('throws GatewayDisabledError when no API_KEY is configured', async () => {\n    const client = new LocalGatewayClient({ apiKey: undefined });\n    await expect(\n      client.generateImage({ prompt: 'a cat' })\n    ).rejects.toMatchObject({ name: 'GatewayDisabledError' });\n  });\n\n  it('calls the configured endpoint with the API key and returns bytes', async () => {\n    const fetch = async (url: string, init?: RequestInit) => {\n      const headers = init?.headers as Record<string, string>;\n      expect(url).toBe('https://gateway.example/v1/images/generate');\n      expect(headers.Authorization).toBe('Bearer test-key');\n      const body = JSON.parse(init?.body as string);\n      expect(body).toMatchObject({ prompt: 'a cat' });\n      return new Response(new Uint8Array([1, 2, 3, 4]), {\n        headers: { 'content-type': 'image/png' }\n      });\n    };\n    const client = new LocalGatewayClient({\n      apiKey: 'test-key',\n      endpoint: 'https://gateway.example/v1/images/generate',\n      fetch: fetch as typeof globalThis.fetch\n    });\n    const out = await client.generateImage({ prompt: 'a cat' });\n    expect(out.mimeType).toBe('image/png');\n    expect(Array.from(out.bytes)).toEqual([1, 2, 3, 4]);\n  });\n});\n"]}

package/dist/test/test/handbook-contract.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=handbook-contract.test.d.ts.map

package/dist/test/test/handbook-contract.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"handbook-contract.test.d.ts","sourceRoot":"","sources":["../../../test/handbook-contract.test.ts"],"names":[],"mappings":""}

package/dist/test/test/handbook-contract.test.js

@@ -1,75 +0,0 @@
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
-import { describe, expect, it } from 'vitest';
-import { loadNodeAssets } from '../src/assets/load-node.js';
-import { createCodesignMcpServer } from '../src/server.js';
-// asset_generate is intentionally absent: it is hidden for the beta (see the
-// ASSET_GENERATE_ENABLED kill-switch in src/tools/index.ts and the commented-out
-// section in the handbook). Re-add it here when the feature ships.
-const TOOL_NAMES_IN_HANDBOOK = [
-    'handbook',
-    'api',
-    'guide',
-    'edit',
-    'preview',
-    'export',
-    'save',
-    'list',
-    'history',
-    'inspect',
-    'rename',
-    'open_editor',
-    'asset_search'
-];
-describe('handbook contract', () => {
-    it('the handbook prose references every tool name we ship', () => {
-        const assets = loadNodeAssets();
-        const handbookText = assets['docs/handbook/SKILL.md'];
-        expect(handbookText).toBeTruthy();
-        for (const tool of TOOL_NAMES_IN_HANDBOOK) {
-            expect(handbookText, `handbook is missing tool name "${tool}"`).toContain(tool);
-        }
-    });
-    it('every tool the handbook names is in tools/list', async () => {
-        const server = createCodesignMcpServer({
-            assets: loadNodeAssets(),
-            tools: [
-                // Stubs with the right names so tools/list returns them. The
-                // handbook contract checks NAMES, not behaviour — full behaviour
-                // is covered in tools/*.test.ts and the evals.
-                ...[
-                    'edit',
-                    'preview',
-                    'export',
-                    'save',
-                    'list',
-                    'history',
-                    'inspect',
-                    'rename',
-                    'open_editor',
-                    'asset_search'
-                ].map((name) => ({
-                    name,
-                    description: `${name} tool stub for handbook-contract check`,
-                    inputSchema: { type: 'object', properties: {} },
-                    call: async () => ({ content: [{ type: 'text', text: '' }] })
-                }))
-            ]
-        });
-        const [c, s] = InMemoryTransport.createLinkedPair();
-        await server.connect(s);
-        const client = new Client({ name: 'test', version: '0' });
-        await client.connect(c);
-        const tools = await client.listTools();
-        const names = tools.tools.map((t) => t.name);
-        for (const expected of TOOL_NAMES_IN_HANDBOOK) {
-            expect(names, `tools/list missing "${expected}"`).toContain(expected);
-        }
-    });
-    it('documents the httpUrl field for export and save', () => {
-        const assets = loadNodeAssets();
-        const handbookText = assets['docs/handbook/SKILL.md'];
-        expect(handbookText).toContain('httpUrl');
-    });
-});
-//# sourceMappingURL=handbook-contract.test.js.map

package/dist/test/test/handbook-contract.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handbook-contract.test.js","sourceRoot":"","sources":["../../../test/handbook-contract.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,6EAA6E;AAC7E,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,sBAAsB,GAAG;IAC7B,UAAU;IACV,KAAK;IACL,OAAO;IACP,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,SAAS;IACT,QAAQ;IACR,aAAa;IACb,cAAc;CACf,CAAC;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,CAAC,YAAY,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC,SAAS,CACvE,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,MAAM,EAAE,cAAc,EAAE;YACxB,KAAK,EAAE;gBACL,6DAA6D;gBAC7D,iEAAiE;gBACjE,+CAA+C;gBAC/C,GAAG;oBACD,MAAM;oBACN,SAAS;oBACT,QAAQ;oBACR,MAAM;oBACN,MAAM;oBACN,SAAS;oBACT,SAAS;oBACT,QAAQ;oBACR,aAAa;oBACb,cAAc;iBACf,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACf,IAAI;oBACJ,WAAW,EAAE,GAAG,IAAI,wCAAwC;oBAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,UAAU,EAAE,EAAE,EAAE;oBACxD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;iBACvE,CAAC,CAAC;aACJ;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7C,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,EAAE,uBAAuB,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';\nimport { describe, expect, it } from 'vitest';\nimport { loadNodeAssets } from '../src/assets/load-node.js';\nimport { createCodesignMcpServer } from '../src/server.js';\n\n// asset_generate is intentionally absent: it is hidden for the beta (see the\n// ASSET_GENERATE_ENABLED kill-switch in src/tools/index.ts and the commented-out\n// section in the handbook). Re-add it here when the feature ships.\nconst TOOL_NAMES_IN_HANDBOOK = [\n  'handbook',\n  'api',\n  'guide',\n  'edit',\n  'preview',\n  'export',\n  'save',\n  'list',\n  'history',\n  'inspect',\n  'rename',\n  'open_editor',\n  'asset_search'\n];\n\ndescribe('handbook contract', () => {\n  it('the handbook prose references every tool name we ship', () => {\n    const assets = loadNodeAssets();\n    const handbookText = assets['docs/handbook/SKILL.md'];\n    expect(handbookText).toBeTruthy();\n    for (const tool of TOOL_NAMES_IN_HANDBOOK) {\n      expect(handbookText, `handbook is missing tool name \"${tool}\"`).toContain(\n        tool\n      );\n    }\n  });\n\n  it('every tool the handbook names is in tools/list', async () => {\n    const server = createCodesignMcpServer({\n      assets: loadNodeAssets(),\n      tools: [\n        // Stubs with the right names so tools/list returns them. The\n        // handbook contract checks NAMES, not behaviour — full behaviour\n        // is covered in tools/*.test.ts and the evals.\n        ...[\n          'edit',\n          'preview',\n          'export',\n          'save',\n          'list',\n          'history',\n          'inspect',\n          'rename',\n          'open_editor',\n          'asset_search'\n        ].map((name) => ({\n          name,\n          description: `${name} tool stub for handbook-contract check`,\n          inputSchema: { type: 'object' as const, properties: {} },\n          call: async () => ({ content: [{ type: 'text' as const, text: '' }] })\n        }))\n      ]\n    });\n    const [c, s] = InMemoryTransport.createLinkedPair();\n    await server.connect(s);\n    const client = new Client({ name: 'test', version: '0' });\n    await client.connect(c);\n    const tools = await client.listTools();\n    const names = tools.tools.map((t) => t.name);\n    for (const expected of TOOL_NAMES_IN_HANDBOOK) {\n      expect(names, `tools/list missing \"${expected}\"`).toContain(expected);\n    }\n  });\n\n  it('documents the httpUrl field for export and save', () => {\n    const assets = loadNodeAssets();\n    const handbookText = assets['docs/handbook/SKILL.md'];\n    expect(handbookText).toContain('httpUrl');\n  });\n});\n"]}

package/dist/test/test/http/server.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=server.test.d.ts.map

package/dist/test/test/http/server.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.test.d.ts","sourceRoot":"","sources":["../../../../test/http/server.test.ts"],"names":[],"mappings":""}

package/dist/test/test/http/server.test.js

@@ -1,374 +0,0 @@
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import request from 'supertest';
-import { createCodesignHttpServer } from '../../src/http/server.js';
-import { WorkspaceAuthError } from '../../src/http/workspace-auth.js';
-import { ScopedWorkspaceFS } from '../../src/workspace/scoped.js';
-import { InMemoryWorkspaceFS } from '../../src/workspace/in-memory.js';
-const FIXTURES = {
-    'docs/alpha/SKILL.md': '---\nname: alpha\ndescription: First.\n---\n# Alpha'
-};
-let nextEngineId = 0;
-function makeServer() {
-    return createCodesignHttpServer({
-        assets: FIXTURES,
-        maxSessions: 5,
-        idleTimeoutMs: 60_000,
-        // Replace the real CE.SDK headless bootstrap with a deterministic fake so
-        // the integration test runs in milliseconds, not seconds. The fake engine
-        // owns its own scriptsRun array, asserting per-session isolation.
-        createSession: async () => {
-            const engine = { id: nextEngineId++, scriptsRun: [] };
-            const tools = [
-                {
-                    name: 'echo',
-                    description: 'Echo arg back',
-                    inputSchema: {
-                        type: 'object',
-                        properties: { msg: { type: 'string' } },
-                        required: ['msg']
-                    },
-                    call: async (args) => {
-                        const msg = args.msg;
-                        return { content: [{ type: 'text', text: msg }] };
-                    }
-                },
-                {
-                    // Records the input on this session's engine and reads back the
-                    // list of all scripts seen so far. Used by the isolation test to
-                    // prove two sessions don't share engine state.
-                    name: 'engine_record',
-                    description: 'Record a string into the session engine, return all recorded so far',
-                    inputSchema: {
-                        type: 'object',
-                        properties: { msg: { type: 'string' } },
-                        required: ['msg']
-                    },
-                    call: async (args) => {
-                        const msg = args.msg;
-                        engine.scriptsRun.push(msg);
-                        return {
-                            content: [
-                                { type: 'text', text: engine.scriptsRun.join(',') }
-                            ]
-                        };
-                    }
-                }
-            ];
-            return { engine, tools };
-        }
-    });
-}
-describe('createCodesignHttpServer', () => {
-    let app;
-    let baseUrl;
-    let server;
-    beforeEach(async () => {
-        nextEngineId = 0;
-        app = await makeServer();
-        await new Promise((resolve) => {
-            server = app.listen(0, '127.0.0.1', resolve);
-        });
-        const addr = server.address();
-        baseUrl = `http://127.0.0.1:${addr.port}/mcp`;
-    });
-    afterEach(async () => {
-        await new Promise((resolve) => server.close(() => resolve()));
-        await app.shutdown();
-    });
-    async function connect() {
-        const transport = new StreamableHTTPClientTransport(new URL(baseUrl));
-        const client = new Client({ name: 'test', version: '0' });
-        await client.connect(transport);
-        return { client, sessionId: transport.sessionId };
-    }
-    it('initialize creates a new session and returns its id', async () => {
-        const { client, sessionId } = await connect();
-        expect(sessionId).toMatch(/[0-9a-f-]{36}/i); // uuid shape
-        expect(app.sessions.size).toBe(1);
-        await client.close();
-    });
-    it("listResources returns the asset bundle's skill files for that session", async () => {
-        const { client } = await connect();
-        const list = await client.listResources();
-        expect(list.resources.map((r) => r.uri)).toEqual([
-            'codesign://docs/alpha/SKILL.md'
-        ]);
-        await client.close();
-    });
-    it("callTool routes to the session's own engine", async () => {
-        const { client } = await connect();
-        const result = await client.callTool({
-            name: 'echo',
-            arguments: { msg: 'hi' }
-        });
-        expect(result.content).toEqual([{ type: 'text', text: 'hi' }]);
-        await client.close();
-    });
-    it('two parallel clients get distinct sessions and engines', async () => {
-        const a = await connect();
-        const b = await connect();
-        expect(a.sessionId).toBeDefined();
-        expect(b.sessionId).toBeDefined();
-        expect(a.sessionId).not.toBe(b.sessionId);
-        expect(app.sessions.size).toBe(2);
-        await a.client.close();
-        await b.client.close();
-    });
-    it('session cap: returns 503 when maxSessions is reached', async () => {
-        await app.shutdown(); // dismiss the default 5-session app
-        app = await createCodesignHttpServer({
-            assets: FIXTURES,
-            maxSessions: 2,
-            idleTimeoutMs: 60_000,
-            createSession: async () => ({
-                engine: { id: nextEngineId++, scriptsRun: [] },
-                tools: []
-            })
-        });
-        await new Promise((resolve) => server.close(() => resolve()));
-        await new Promise((resolve) => {
-            server = app.listen(0, '127.0.0.1', resolve);
-        });
-        const addr = server.address();
-        baseUrl = `http://127.0.0.1:${addr.port}/mcp`;
-        const a = await connect();
-        const b = await connect();
-        // 3rd init request should be rejected at the HTTP layer with 503.
-        const initBody = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2025-03-26',
-                capabilities: {},
-                clientInfo: { name: 't', version: '0' }
-            }
-        };
-        const r = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream'
-            },
-            body: JSON.stringify(initBody)
-        });
-        expect(r.status).toBe(503);
-        expect(r.headers.get('retry-after')).toBe('30');
-        const json = (await r.json());
-        expect(json.error.code).toBe(-32000);
-        expect(json.error.message).toMatch(/session cap/i);
-        await a.client.close();
-        await b.client.close();
-    });
-    it('unknown session id: returns 404 with -32001', async () => {
-        const r = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream',
-                'mcp-session-id': '00000000-0000-0000-0000-000000000000'
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list',
-                params: {}
-            })
-        });
-        expect(r.status).toBe(404);
-        const json = (await r.json());
-        expect(json.error.code).toBe(-32001);
-        expect(json.error.message).toMatch(/unknown session/);
-    });
-    it('graceful DELETE /mcp terminates the session and frees its slot', async () => {
-        const { sessionId } = await connect();
-        expect(sessionId).toBeDefined();
-        expect(app.sessions.size).toBe(1);
-        const r = await fetch(baseUrl, {
-            method: 'DELETE',
-            headers: { 'mcp-session-id': sessionId }
-        });
-        expect(r.status).toBe(200);
-        // onsessionclosed → sessionMgr.delete: the slot (and its engine) is
-        // reclaimed immediately, not left squatting until idle eviction.
-        expect(app.sessions.size).toBe(0);
-        // The id is now unknown — a follow-up request 404s.
-        const followUp = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream',
-                'mcp-session-id': sessionId
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'tools/list',
-                params: {}
-            })
-        });
-        expect(followUp.status).toBe(404);
-    });
-    it('auth middleware rejects requests with 401 when configured to', async () => {
-        await app.shutdown();
-        await new Promise((resolve) => server.close(() => resolve()));
-        app = await createCodesignHttpServer({
-            assets: FIXTURES,
-            maxSessions: 5,
-            idleTimeoutMs: 60_000,
-            createSession: async () => ({
-                engine: { id: nextEngineId++, scriptsRun: [] },
-                tools: []
-            }),
-            auth: (req, res, next) => {
-                if (req.header('authorization') !== 'Bearer testtoken') {
-                    res.status(401).json({ error: 'unauthorized' });
-                    return;
-                }
-                next();
-            }
-        });
-        await new Promise((resolve) => {
-            server = app.listen(0, '127.0.0.1', resolve);
-        });
-        const addr = server.address();
-        baseUrl = `http://127.0.0.1:${addr.port}/mcp`;
-        const r = await fetch(baseUrl, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                accept: 'application/json, text/event-stream'
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'initialize',
-                params: {}
-            })
-        });
-        expect(r.status).toBe(401);
-    });
-    it('engine state is isolated per session: mutation in one is invisible to the other', async () => {
-        const a = await connect();
-        const b = await connect();
-        // Record on a — only a should see it.
-        const aResult = await a.client.callTool({
-            name: 'engine_record',
-            arguments: { msg: 'from-a' }
-        });
-        expect(aResult.content).toEqual([{ type: 'text', text: 'from-a' }]);
-        // Record on b — should NOT include from-a.
-        const bResult = await b.client.callTool({
-            name: 'engine_record',
-            arguments: { msg: 'from-b' }
-        });
-        expect(bResult.content).toEqual([{ type: 'text', text: 'from-b' }]);
-        // Re-record on a — should append to a's history, still no b.
-        const aResult2 = await a.client.callTool({
-            name: 'engine_record',
-            arguments: { msg: 'again' }
-        });
-        expect(aResult2.content).toEqual([{ type: 'text', text: 'from-a,again' }]);
-        await a.client.close();
-        await b.client.close();
-    });
-    it('passes the resolved workspaceId to createSession on initialize', async () => {
-        const seen = [];
-        const testApp = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            resolveWorkspaceId: (req) => req.header('x-workspace-id') ?? 'fallback',
-            createSession: async ({ workspaceId }) => {
-                seen.push(workspaceId);
-                return { engine: {}, tools: [] };
-            }
-        });
-        await request(testApp)
-            .post('/mcp')
-            .set('x-workspace-id', 'u/acme')
-            .set('content-type', 'application/json')
-            .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
-        expect(seen).toEqual(['u/acme']);
-        await testApp.shutdown();
-    });
-    it('returns 401 when resolveWorkspaceId throws WorkspaceAuthError', async () => {
-        const testApp = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            resolveWorkspaceId: () => {
-                throw new WorkspaceAuthError('missing header');
-            },
-            createSession: async () => ({ engine: {}, tools: [] })
-        });
-        const res = await request(testApp)
-            .post('/mcp')
-            .set('content-type', 'application/json')
-            .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
-        expect(res.status).toBe(401);
-        expect(res.body.error.code).toBe(-32002);
-        expect(res.body.error.message).toBe('missing header');
-        await testApp.shutdown();
-    });
-    it('returns 400 (not a hang) when the resolved workspaceId is malformed', async () => {
-        const testApp = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            // header mode-style: return an illegal id that ScopedWorkspaceFS will reject
-            resolveWorkspaceId: () => '../escape',
-            createSession: async ({ workspaceId }) => {
-                // mirror cli/http.ts: constructing the scoped fs validates the id
-                new ScopedWorkspaceFS(new InMemoryWorkspaceFS(), workspaceId);
-                return { engine: {}, tools: [] };
-            }
-        });
-        const res = await request(testApp)
-            .post('/mcp')
-            .set('content-type', 'application/json')
-            .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
-        expect(res.status).toBe(400);
-        expect(res.body.error.code).toBe(-32602); // invalid params
-        await testApp.shutdown();
-    });
-    it('forwards the metrics recorder so tool calls are timed', async () => {
-        const { MetricsRecorder } = await import('../../src/metrics/recorder.js');
-        const recorder = new MetricsRecorder();
-        const a2 = await createCodesignHttpServer({
-            assets: {},
-            maxSessions: 4,
-            idleTimeoutMs: 60_000,
-            metrics: recorder,
-            createSession: async () => ({
-                engine: {},
-                tools: [
-                    {
-                        name: 'ping',
-                        description: 'ping',
-                        inputSchema: { type: 'object', properties: {} },
-                        call: async () => ({
-                            content: [{ type: 'text', text: 'pong' }]
-                        })
-                    }
-                ]
-            })
-        });
-        const srv = await new Promise((resolve) => {
-            const s = a2.listen(0, '127.0.0.1', () => resolve(s));
-        });
-        const addr = srv.address();
-        const url = `http://127.0.0.1:${addr.port}/mcp`;
-        const transport = new StreamableHTTPClientTransport(new URL(url));
-        const client = new Client({ name: 'test', version: '0' });
-        await client.connect(transport);
-        await client.callTool({ name: 'ping', arguments: {} });
-        await client.close();
-        await new Promise((resolve) => srv.close(() => resolve()));
-        await a2.shutdown();
-        expect(recorder.snapshot().tools.find((t) => t.tool === 'ping')?.count).toBe(1);
-    });
-});
-//# sourceMappingURL=server.test.js.map

package/dist/test/test/http/server.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.test.js","sourceRoot":"","sources":["../../../../test/http/server.test.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,MAAM,QAAQ,GAAG;IACf,qBAAqB,EAAE,qDAAqD;CAC7E,CAAC;AAOF,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,UAAU;IACjB,OAAO,wBAAwB,CAAC;QAC9B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,CAAC;QACd,aAAa,EAAE,MAAM;QACrB,0EAA0E;QAC1E,0EAA0E;QAC1E,kEAAkE;QAClE,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,MAAM,MAAM,GAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG;gBACZ;oBACE,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,eAAe;oBAC5B,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACvC,QAAQ,EAAE,CAAC,KAAK,CAAC;qBAClB;oBACD,IAAI,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;wBAC5B,MAAM,GAAG,GAAI,IAAwB,CAAC,GAAG,CAAC;wBAC1C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBACD;oBACE,gEAAgE;oBAChE,iEAAiE;oBACjE,+CAA+C;oBAC/C,IAAI,EAAE,eAAe;oBACrB,WAAW,EACT,qEAAqE;oBACvE,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACvC,QAAQ,EAAE,CAAC,KAAK,CAAC;qBAClB;oBACD,IAAI,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;wBAC5B,MAAM,GAAG,GAAI,IAAwB,CAAC,GAAG,CAAC;wBAC1C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC5B,OAAO;4BACL,OAAO,EAAE;gCACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;6BAC7D;yBACF,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,GAAyD,CAAC;IAC9D,IAAI,OAAe,CAAC;IACpB,IAAI,MAAqC,CAAC;IAE1C,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,YAAY,GAAG,CAAC,CAAC;QACjB,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAC7C,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,OAAO;QAIpB,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IAED,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa;QAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/C,gCAAgC;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,oCAAoC;QAC1D,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACnC,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC9C,KAAK,EAAE,EAAE;aACV,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAC7C,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;QAE9C,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,kEAAkE;QAClE,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACxC;SACF,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAE3B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAEnD,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,gBAAgB,EAAE,sCAAsC;aACzD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAE3B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,gBAAgB,EAAE,SAAmB,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElC,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,gBAAgB,EAAE,SAAmB;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACnC,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC9C,KAAK,EAAE,EAAE;aACV,CAAC;YACF,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,kBAAkB,EAAE,CAAC;oBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,CAAC;YACT,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAC7C,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;QAE9C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAE1B,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEpE,2CAA2C;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEpE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,UAAU;YACvE,aAAa,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBACvC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACnC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC;aACnB,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC;aAC/B,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,kBAAkB,EAAE,GAAG,EAAE;gBACvB,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACjD,CAAC;YACD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;aAC/B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,6EAA6E;YAC7E,kBAAkB,EAAE,GAAG,EAAE,CAAC,WAAW;YACrC,aAAa,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBACvC,kEAAkE;gBAClE,IAAI,iBAAiB,CAAC,IAAI,mBAAmB,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC9D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACnC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;aAC/B,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;aACvC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;QAC3D,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,QAAQ;YACjB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,MAAM;wBACZ,WAAW,EAAE,MAAM;wBACnB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;wBAC/C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;4BACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;yBACnD,CAAC;qBACH;iBACF;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAA+B,CAAC,OAAO,EAAE,EAAE;YACtE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAiB,CAAC;QAC1C,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,MAAM,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CACJ,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,CAChE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import type { AddressInfo } from 'node:net';\nimport { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport { afterEach, beforeEach, describe, expect, it } from 'vitest';\nimport request from 'supertest';\nimport { createCodesignHttpServer } from '../../src/http/server.js';\nimport { WorkspaceAuthError } from '../../src/http/workspace-auth.js';\nimport { ScopedWorkspaceFS } from '../../src/workspace/scoped.js';\nimport { InMemoryWorkspaceFS } from '../../src/workspace/in-memory.js';\n\nconst FIXTURES = {\n  'docs/alpha/SKILL.md': '---\\nname: alpha\\ndescription: First.\\n---\\n# Alpha'\n};\n\ninterface FakeEngine {\n  id: number;\n  scriptsRun: string[];\n}\n\nlet nextEngineId = 0;\n\nfunction makeServer() {\n  return createCodesignHttpServer({\n    assets: FIXTURES,\n    maxSessions: 5,\n    idleTimeoutMs: 60_000,\n    // Replace the real CE.SDK headless bootstrap with a deterministic fake so\n    // the integration test runs in milliseconds, not seconds. The fake engine\n    // owns its own scriptsRun array, asserting per-session isolation.\n    createSession: async () => {\n      const engine: FakeEngine = { id: nextEngineId++, scriptsRun: [] };\n      const tools = [\n        {\n          name: 'echo',\n          description: 'Echo arg back',\n          inputSchema: {\n            type: 'object',\n            properties: { msg: { type: 'string' } },\n            required: ['msg']\n          },\n          call: async (args: unknown) => {\n            const msg = (args as { msg: string }).msg;\n            return { content: [{ type: 'text' as const, text: msg }] };\n          }\n        },\n        {\n          // Records the input on this session's engine and reads back the\n          // list of all scripts seen so far. Used by the isolation test to\n          // prove two sessions don't share engine state.\n          name: 'engine_record',\n          description:\n            'Record a string into the session engine, return all recorded so far',\n          inputSchema: {\n            type: 'object',\n            properties: { msg: { type: 'string' } },\n            required: ['msg']\n          },\n          call: async (args: unknown) => {\n            const msg = (args as { msg: string }).msg;\n            engine.scriptsRun.push(msg);\n            return {\n              content: [\n                { type: 'text' as const, text: engine.scriptsRun.join(',') }\n              ]\n            };\n          }\n        }\n      ];\n      return { engine, tools };\n    }\n  });\n}\n\ndescribe('createCodesignHttpServer', () => {\n  let app: Awaited<ReturnType<typeof createCodesignHttpServer>>;\n  let baseUrl: string;\n  let server: ReturnType<typeof app.listen>;\n\n  beforeEach(async () => {\n    nextEngineId = 0;\n    app = await makeServer();\n    await new Promise<void>((resolve) => {\n      server = app.listen(0, '127.0.0.1', resolve);\n    });\n    const addr = server.address() as AddressInfo;\n    baseUrl = `http://127.0.0.1:${addr.port}/mcp`;\n  });\n\n  afterEach(async () => {\n    await new Promise<void>((resolve) => server.close(() => resolve()));\n    await app.shutdown();\n  });\n\n  async function connect(): Promise<{\n    client: Client;\n    sessionId: string | undefined;\n  }> {\n    const transport = new StreamableHTTPClientTransport(new URL(baseUrl));\n    const client = new Client({ name: 'test', version: '0' });\n    await client.connect(transport);\n    return { client, sessionId: transport.sessionId };\n  }\n\n  it('initialize creates a new session and returns its id', async () => {\n    const { client, sessionId } = await connect();\n    expect(sessionId).toMatch(/[0-9a-f-]{36}/i); // uuid shape\n    expect(app.sessions.size).toBe(1);\n    await client.close();\n  });\n\n  it(\"listResources returns the asset bundle's skill files for that session\", async () => {\n    const { client } = await connect();\n    const list = await client.listResources();\n    expect(list.resources.map((r) => r.uri)).toEqual([\n      'codesign://docs/alpha/SKILL.md'\n    ]);\n    await client.close();\n  });\n\n  it(\"callTool routes to the session's own engine\", async () => {\n    const { client } = await connect();\n    const result = await client.callTool({\n      name: 'echo',\n      arguments: { msg: 'hi' }\n    });\n    expect(result.content).toEqual([{ type: 'text', text: 'hi' }]);\n    await client.close();\n  });\n\n  it('two parallel clients get distinct sessions and engines', async () => {\n    const a = await connect();\n    const b = await connect();\n    expect(a.sessionId).toBeDefined();\n    expect(b.sessionId).toBeDefined();\n    expect(a.sessionId).not.toBe(b.sessionId);\n    expect(app.sessions.size).toBe(2);\n    await a.client.close();\n    await b.client.close();\n  });\n\n  it('session cap: returns 503 when maxSessions is reached', async () => {\n    await app.shutdown(); // dismiss the default 5-session app\n    app = await createCodesignHttpServer({\n      assets: FIXTURES,\n      maxSessions: 2,\n      idleTimeoutMs: 60_000,\n      createSession: async () => ({\n        engine: { id: nextEngineId++, scriptsRun: [] },\n        tools: []\n      })\n    });\n    await new Promise<void>((resolve) => server.close(() => resolve()));\n    await new Promise<void>((resolve) => {\n      server = app.listen(0, '127.0.0.1', resolve);\n    });\n    const addr = server.address() as AddressInfo;\n    baseUrl = `http://127.0.0.1:${addr.port}/mcp`;\n\n    const a = await connect();\n    const b = await connect();\n    // 3rd init request should be rejected at the HTTP layer with 503.\n    const initBody = {\n      jsonrpc: '2.0',\n      id: 1,\n      method: 'initialize',\n      params: {\n        protocolVersion: '2025-03-26',\n        capabilities: {},\n        clientInfo: { name: 't', version: '0' }\n      }\n    };\n    const r = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream'\n      },\n      body: JSON.stringify(initBody)\n    });\n    expect(r.status).toBe(503);\n    expect(r.headers.get('retry-after')).toBe('30');\n    const json = (await r.json()) as {\n      error: { code: number; message: string };\n    };\n    expect(json.error.code).toBe(-32000);\n    expect(json.error.message).toMatch(/session cap/i);\n\n    await a.client.close();\n    await b.client.close();\n  });\n\n  it('unknown session id: returns 404 with -32001', async () => {\n    const r = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream',\n        'mcp-session-id': '00000000-0000-0000-0000-000000000000'\n      },\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n        params: {}\n      })\n    });\n    expect(r.status).toBe(404);\n    const json = (await r.json()) as {\n      error: { code: number; message: string };\n    };\n    expect(json.error.code).toBe(-32001);\n    expect(json.error.message).toMatch(/unknown session/);\n  });\n\n  it('graceful DELETE /mcp terminates the session and frees its slot', async () => {\n    const { sessionId } = await connect();\n    expect(sessionId).toBeDefined();\n    expect(app.sessions.size).toBe(1);\n\n    const r = await fetch(baseUrl, {\n      method: 'DELETE',\n      headers: { 'mcp-session-id': sessionId as string }\n    });\n    expect(r.status).toBe(200);\n    // onsessionclosed → sessionMgr.delete: the slot (and its engine) is\n    // reclaimed immediately, not left squatting until idle eviction.\n    expect(app.sessions.size).toBe(0);\n\n    // The id is now unknown — a follow-up request 404s.\n    const followUp = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream',\n        'mcp-session-id': sessionId as string\n      },\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'tools/list',\n        params: {}\n      })\n    });\n    expect(followUp.status).toBe(404);\n  });\n\n  it('auth middleware rejects requests with 401 when configured to', async () => {\n    await app.shutdown();\n    await new Promise<void>((resolve) => server.close(() => resolve()));\n    app = await createCodesignHttpServer({\n      assets: FIXTURES,\n      maxSessions: 5,\n      idleTimeoutMs: 60_000,\n      createSession: async () => ({\n        engine: { id: nextEngineId++, scriptsRun: [] },\n        tools: []\n      }),\n      auth: (req, res, next) => {\n        if (req.header('authorization') !== 'Bearer testtoken') {\n          res.status(401).json({ error: 'unauthorized' });\n          return;\n        }\n        next();\n      }\n    });\n    await new Promise<void>((resolve) => {\n      server = app.listen(0, '127.0.0.1', resolve);\n    });\n    const addr = server.address() as AddressInfo;\n    baseUrl = `http://127.0.0.1:${addr.port}/mcp`;\n\n    const r = await fetch(baseUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json, text/event-stream'\n      },\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method: 'initialize',\n        params: {}\n      })\n    });\n    expect(r.status).toBe(401);\n  });\n\n  it('engine state is isolated per session: mutation in one is invisible to the other', async () => {\n    const a = await connect();\n    const b = await connect();\n\n    // Record on a — only a should see it.\n    const aResult = await a.client.callTool({\n      name: 'engine_record',\n      arguments: { msg: 'from-a' }\n    });\n    expect(aResult.content).toEqual([{ type: 'text', text: 'from-a' }]);\n\n    // Record on b — should NOT include from-a.\n    const bResult = await b.client.callTool({\n      name: 'engine_record',\n      arguments: { msg: 'from-b' }\n    });\n    expect(bResult.content).toEqual([{ type: 'text', text: 'from-b' }]);\n\n    // Re-record on a — should append to a's history, still no b.\n    const aResult2 = await a.client.callTool({\n      name: 'engine_record',\n      arguments: { msg: 'again' }\n    });\n    expect(aResult2.content).toEqual([{ type: 'text', text: 'from-a,again' }]);\n\n    await a.client.close();\n    await b.client.close();\n  });\n\n  it('passes the resolved workspaceId to createSession on initialize', async () => {\n    const seen: string[] = [];\n    const testApp = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      resolveWorkspaceId: (req) => req.header('x-workspace-id') ?? 'fallback',\n      createSession: async ({ workspaceId }) => {\n        seen.push(workspaceId);\n        return { engine: {}, tools: [] };\n      }\n    });\n    await request(testApp)\n      .post('/mcp')\n      .set('x-workspace-id', 'u/acme')\n      .set('content-type', 'application/json')\n      .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });\n    expect(seen).toEqual(['u/acme']);\n    await testApp.shutdown();\n  });\n\n  it('returns 401 when resolveWorkspaceId throws WorkspaceAuthError', async () => {\n    const testApp = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      resolveWorkspaceId: () => {\n        throw new WorkspaceAuthError('missing header');\n      },\n      createSession: async () => ({ engine: {}, tools: [] })\n    });\n    const res = await request(testApp)\n      .post('/mcp')\n      .set('content-type', 'application/json')\n      .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });\n    expect(res.status).toBe(401);\n    expect(res.body.error.code).toBe(-32002);\n    expect(res.body.error.message).toBe('missing header');\n    await testApp.shutdown();\n  });\n\n  it('returns 400 (not a hang) when the resolved workspaceId is malformed', async () => {\n    const testApp = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      // header mode-style: return an illegal id that ScopedWorkspaceFS will reject\n      resolveWorkspaceId: () => '../escape',\n      createSession: async ({ workspaceId }) => {\n        // mirror cli/http.ts: constructing the scoped fs validates the id\n        new ScopedWorkspaceFS(new InMemoryWorkspaceFS(), workspaceId);\n        return { engine: {}, tools: [] };\n      }\n    });\n    const res = await request(testApp)\n      .post('/mcp')\n      .set('content-type', 'application/json')\n      .send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });\n    expect(res.status).toBe(400);\n    expect(res.body.error.code).toBe(-32602); // invalid params\n    await testApp.shutdown();\n  });\n\n  it('forwards the metrics recorder so tool calls are timed', async () => {\n    const { MetricsRecorder } = await import('../../src/metrics/recorder.js');\n    const recorder = new MetricsRecorder();\n    const a2 = await createCodesignHttpServer({\n      assets: {},\n      maxSessions: 4,\n      idleTimeoutMs: 60_000,\n      metrics: recorder,\n      createSession: async () => ({\n        engine: {},\n        tools: [\n          {\n            name: 'ping',\n            description: 'ping',\n            inputSchema: { type: 'object', properties: {} },\n            call: async () => ({\n              content: [{ type: 'text' as const, text: 'pong' }]\n            })\n          }\n        ]\n      })\n    });\n    const srv = await new Promise<ReturnType<typeof a2.listen>>((resolve) => {\n      const s = a2.listen(0, '127.0.0.1', () => resolve(s));\n    });\n    const addr = srv.address() as AddressInfo;\n    const url = `http://127.0.0.1:${addr.port}/mcp`;\n    const transport = new StreamableHTTPClientTransport(new URL(url));\n    const client = new Client({ name: 'test', version: '0' });\n    await client.connect(transport);\n    await client.callTool({ name: 'ping', arguments: {} });\n    await client.close();\n    await new Promise<void>((resolve) => srv.close(() => resolve()));\n    await a2.shutdown();\n    expect(\n      recorder.snapshot().tools.find((t) => t.tool === 'ping')?.count\n    ).toBe(1);\n  });\n});\n"]}

package/dist/test/test/http/session-id-header.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=session-id-header.test.d.ts.map

package/dist/test/test/http/session-id-header.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-id-header.test.d.ts","sourceRoot":"","sources":["../../../../test/http/session-id-header.test.ts"],"names":[],"mappings":""}