@jrpool/kilotest 48.0.0 → 49.0.0

package/index.ts

@@ -11,6 +11,7 @@ import {
   createLock,
   deleteTestRequests,
   errorMessage,
+  getExclusionCookieValue,
   getJobNames,
   getJSON,
   getObject,
@@ -24,6 +25,8 @@ import {
   isJobID,
   isUsableReport,
   jobsPath,
+  metricsExclusionCookieName,
+  recordMetric,
   reportsPath
 } from './util.ts';
 import {sendAlert} from './alerts.ts';
@@ -49,6 +52,7 @@ import {answer as listRules} from './web/listRules/index.ts';
 import {answer as listTopIssues} from './web/listTopIssues/index.ts';
 import {answer as listViolatorsPage} from './web/listViolators/index.ts';
 import {answer as manage} from './web/manage/index.ts';
+import {answer as metrics} from './web/metrics/index.ts';
 import {answer as pruneReportsForm} from './web/pruneReportsForm/index.ts';
 import {answer as reannotate} from './web/reannotate/index.ts';
 import {answer as reannotateForm} from './web/reannotateForm/index.ts';
@@ -59,6 +63,7 @@ import {answer as requestRetestForm} from './web/requestRetestForm/index.ts';
 import {answer as requestTestPage} from './web/requestTest/index.ts';
 import {answer as requestTestForm} from './web/requestTestForm/index.ts';
 import {answer as rewindReportsForm} from './web/rewindReportsForm/index.ts';
+import {answer as showHiddenReportsForm} from './web/showHiddenReportsForm/index.ts';
 import {answer as unhideReportForm} from './web/unhideReportForm/index.ts';
 import {response as getReportAPI} from './api/getReport.ts';
 import {response as listDiagnosesAPI} from './api/listDiagnoses.ts';
@@ -76,7 +81,15 @@ dotenv.config({quiet: true});
 // CONSTANTS
 
 // The data returned by a page-answering handler.
-type AnswerData = {status: string; message?: string; answerPage?: string};
+type AnswerData = {
+  status: string;
+  message?: string;
+  answerPage?: string;
+  // A cookie an answer() handler wants set on the response. Generic, not metrics-specific:
+  // handlers return data and never touch the response object directly, so this is how one
+  // asks index.ts, which owns the response, to set a cookie on its behalf.
+  setCookie?: {name: string; value: string; maxAgeSeconds: number};
+};
 // A page-answering handler, whose parameters vary by topic.
 type PageHandler = (...args: any[]) => Promise<AnswerData>;
 
@@ -93,6 +106,7 @@ const answer: {
   listTopIssues: PageHandler;
   listViolators: PageHandler;
   manage: PageHandler;
+  metrics: PageHandler;
   pruneReportsForm: PageHandler;
   tutorialWeb: PageHandler;
   tutorialAI: PageHandler;
@@ -105,6 +119,7 @@ const answer: {
   requestTest: PageHandler;
   requestTestForm: PageHandler;
   rewindReportsForm: PageHandler;
+  showHiddenReportsForm: PageHandler;
   unhideReportForm: PageHandler;
   [key: string]: PageHandler | undefined;
 } = {
@@ -120,6 +135,7 @@ const answer: {
   listTopIssues,
   listViolators: listViolatorsPage,
   manage,
+  metrics,
   pruneReportsForm,
   tutorialWeb,
   tutorialAI,
@@ -132,6 +148,7 @@ const answer: {
   requestTest: requestTestPage,
   requestTestForm,
   rewindReportsForm,
+  showHiddenReportsForm,
   unhideReportForm
 };
 // Response functions of the API services.
@@ -187,6 +204,13 @@ export const routes = {
   POST: [
     '/api/*',
     '/mcp',
+    '/ai0BalanceForm.html',
+    '/expungeReportsForm.html',
+    '/hideReportForm.html',
+    '/metrics.html',
+    '/pruneReportsForm.html',
+    '/rewindReportsForm.html',
+    '/showHiddenReportsForm.html',
     '/tutorialAIComment.html',
     '/reannotate.html',
     '/requestAction.html',
@@ -194,10 +218,48 @@ export const routes = {
     '/requestRetest.html/*',
     '/requestTest.html',
     '/tutorialWebComment.html',
+    '/unhideReportForm.html',
     '/worker/job',
     '/worker/report'
   ]
 };
+// The set of page topics (answer{} keys) that are manager-only pages, linked from
+// manage.html. Their views and submissions are recorded under the managerActivity
+// metrics category instead of pageViews, since they are the maintainer operating
+// Kilotest rather than the usage the observability plan's questions are about.
+const managerPages = new Set([
+  'enqueueForm',
+  'reannotateForm',
+  'pruneReportsForm',
+  'rewindReportsForm',
+  'expungeReportsForm',
+  'hideReportForm',
+  'showHiddenReportsForm',
+  'unhideReportForm',
+  'ai0BalanceForm',
+  'renewWCAGForm',
+  'metrics'
+]);
+// The set of manager pages (a subset of managerPages) whose single answer() function both
+// displays a form on GET and processes that form's own submission on POST, as opposed to
+// enqueueForm/reannotateForm, whose submissions post to a separate action page. This
+// governs POST dispatch for all of these pages, and GET dispatch for all except
+// unhideReportForm (see noDirectGetPages below).
+const selfSubmittingManagerPages = new Set([
+  'pruneReportsForm',
+  'rewindReportsForm',
+  'expungeReportsForm',
+  'hideReportForm',
+  'showHiddenReportsForm',
+  'unhideReportForm',
+  'ai0BalanceForm',
+  'metrics'
+]);
+// The subset of selfSubmittingManagerPages that must never be served on a direct GET
+// request, only as the response to another page's successful submission (here,
+// unhideReportForm is served only by showHiddenReportsForm, once a valid authorization code
+// has been submitted), so that the names of hidden reports are never disclosed without one.
+const noDirectGetPages = new Set(['unhideReportForm']);
 const jobLock = createLock();
 
 // FUNCTIONS
@@ -264,6 +326,18 @@ export const getAbuseError = (request: IncomingMessage, reason: string | undefin
     time: new Date().toISOString()
   };
 };
+// Returns whether a request carries the metrics-exclusion cookie with the value that
+// proves it. A request without a valid AUTH_CODE configured can never match, since
+// getExclusionCookieValue then hashes an empty string, which no cookie should equal.
+const isMetricsExcluded = (request: IncomingMessage): boolean => {
+  const header = request.headers.cookie;
+  if (!header || !process.env.AUTH_CODE) {
+    return false;
+  }
+  const cookies = header.split(';').map(pair => pair.trim().split('='));
+  const cookieValue = cookies.find(([name]) => name === metricsExclusionCookieName)?.[1];
+  return cookieValue === getExclusionCookieValue();
+};
 // Gets the ID and secret from a request's HTTP Basic Authorization header, or null if the header
 // is absent or malformed.
 const getBasicAuth = (request: IncomingMessage) => {
@@ -311,7 +385,21 @@ const processJobRequest = async (request: IncomingMessage, response: ServerRespo
   const claimedJobNames = jobNames.claimed;
   // For each claimed job:
   for (const jobName of claimedJobNames) {
-    const job = await getObject(path.join(jobsPath(), 'claimed', jobName));
+    // A claimed-job file can disappear between the directory listing above and this
+    // read, because report submission (which deletes or reclassifies claimed jobs) is
+    // not serialized by jobLock. That race is a normal, recoverable condition, so the
+    // job is skipped rather than treated as defective; any other failure to read it
+    // should never occur and is left to propagate.
+    let job: unknown;
+    try {
+      job = await getObject(path.join(jobsPath(), 'claimed', jobName));
+    }
+    catch (error: unknown) {
+      if (error instanceof Error && (error.cause as NodeJS.ErrnoException | undefined)?.code === 'ENOENT') {
+        continue;
+      }
+      throw error;
+    }
     const {id, sources} = job as {id: string, sources: {worker: string}};
     const {worker} = sources;
     // If its assignee is the worker:
@@ -399,6 +487,20 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     response.end('{}');
     return;
   }
+  // Records a pageViews or apiOperations metric, unless this request's browser has proven,
+  // via a valid authCode submitted earlier on metrics.html, that it belongs to the
+  // maintainer testing Kilotest manually rather than to real usage.
+  const recordPageMetric = (category: 'pageViews' | 'apiOperations', name: string): Promise<void> =>
+    isMetricsExcluded(request) ? Promise.resolve() : recordMetric(category, name);
+  // Applies a cookie an answer() handler asked to have set on the response.
+  const applySetCookie = (answerData: AnswerData): void => {
+    if (answerData.setCookie) {
+      const {name, value, maxAgeSeconds} = answerData.setCookie;
+      response.setHeader(
+        'Set-Cookie', `${name}=${value}; Max-Age=${maxAgeSeconds}; Path=/; HttpOnly; SameSite=Strict`
+      );
+    }
+  };
   // If the request is a GET request:
   if (method === 'GET') {
     // If the path is not authorized for GET requests:
@@ -423,6 +525,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     }
     // Otherwise, if it is for the home page:
     else if (['/', '/index.html'].includes(pathname)) {
+      await recordPageMetric('pageViews', 'index');
       // Get the home page.
       const homePage = await fs.readFile('index.html', 'utf8');
       // Serve it.
@@ -533,20 +636,38 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     // Otherwise, if it is for an HTML page other than the home page:
     else if (pageName.endsWith('.html')) {
       const topic = pageName.slice(0, -5);
-      // If the page can be generated and is not POST-only (a POST-only path also
-      // matches the '*.html*' GET pattern, but its handler expects POST's argument
-      // list and performs no GET-appropriate rendering):
-      if (answer[topic] && !isPathAllowed('POST', pathname)) {
+      // If the page can be generated and is not POST-only (a POST-only path also matches
+      // the '*.html*' GET pattern, but its handler expects POST's argument list and
+      // performs no GET-appropriate rendering; a self-submitting manager page is POST-allowed
+      // too, but its handler serves both methods the same way, so it is not excluded here,
+      // except for a page in noDirectGetPages, which stays excluded from GET even though
+      // it is self-submitting, since it must be reachable only via another page's POST):
+      if (
+        answer[topic] &&
+        !noDirectGetPages.has(topic) &&
+        (!isPathAllowed('POST', pathname) || selfSubmittingManagerPages.has(topic))
+      ) {
         setHeaders('text/html', pathname, 'ultra');
-        // Get the answer data.
-        const answerData = await answer[topic](pathTail, search);
+        // Get the answer data. The method is passed so that a self-submitting manager
+        // page's handler can tell a form-display GET from its own submission POST.
+        const answerData = await answer[topic](pathTail, search, method);
         // If they are valid:
         if (answerData.status === 'ok') {
+          if (managerPages.has(topic)) {
+            await recordMetric('managerActivity', topic, 'ok');
+          }
+          else {
+            await recordPageMetric('pageViews', topic);
+          }
+          applySetCookie(answerData);
           // Serve the answer page.
           response.end(answerData.answerPage);
         }
         // Otherwise, i.e. if they are invalid:
         else {
+          if (managerPages.has(topic)) {
+            await recordMetric('managerActivity', topic, 'error');
+          }
           // Report the error as suspected abuse.
           await serveError(getAbuseError(request, answerData.message), response, true);
         }
@@ -564,6 +685,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       if (service === 'listReports') {
         // Get the response body.
         const responseBody = await apiRespond.listReports([]);
+        await recordPageMetric('apiOperations', 'listReports');
         // Send it.
         setHeaders('application/json', null, 'ultra');
         response.end(JSON.stringify(responseBody));
@@ -572,6 +694,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (service === 'listIssues') {
         // Get the response body.
         const responseBody = await apiRespond.listIssues(specs);
+        await recordPageMetric('apiOperations', 'listIssues');
         // Send it.
         setHeaders('application/json', null, 'high');
         response.end(JSON.stringify(responseBody));
@@ -580,6 +703,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (service === 'listViolators') {
         // Get the response body.
         const responseBody = await apiRespond.listViolators(specs);
+        await recordPageMetric('apiOperations', 'listViolators');
         // Send it.
         setHeaders('application/json', null, 'high');
         response.end(JSON.stringify(responseBody));
@@ -588,6 +712,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (service === 'listDiagnoses') {
         // Get the response body.
         const responseBody = await apiRespond.listDiagnoses(specs);
+        await recordPageMetric('apiOperations', 'listDiagnoses');
         // Send it.
         setHeaders('application/json', null, 'high');
         response.end(JSON.stringify(responseBody));
@@ -596,6 +721,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (service === 'getReport') {
         // Get the response body.
         const responseBody = await apiRespond.getReport(specs);
+        await recordPageMetric('apiOperations', 'getReport');
         // Send it.
         setHeaders('application/json', null, 'low');
         response.end(JSON.stringify(responseBody));
@@ -762,17 +888,20 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
             const answerData = await answer.enqueue(url, description, authCode);
             // If the answer data are valid:
             if (answerData.status === 'ok') {
+              await recordMetric('managerActivity', 'requestAction.html', 'ok');
               // Serve the test-order page with the remaining recommendations.
               response.end(answerData.answerPage);
             }
             // Otherwise, i.e. if they are invalid:
             else {
+              await recordMetric('managerActivity', 'requestAction.html', 'error');
               // Report the error.
               await serveError({message: answerData.message}, response, true);
             }
           }
           // Otherwise, i.e. if it is a rejection:
           else {
+            await recordMetric('managerActivity', 'requestAction.html', 'ok');
             // Delete the test requests for the URL.
             await deleteTestRequests(url);
             // Set a location header for a response.
@@ -785,8 +914,10 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         }
         // Otherwise, i.e. if the request is invalid:
         else {
-          // Report the error.
-          await serveError({message: 'ERROR: Invalid test order'}, response, true);
+          await recordMetric('managerActivity', 'requestAction.html', 'error');
+          // Report the error, deliberately vague so as not to confirm to an attacker
+          // which part of the request (the URL, or the authorization code) was wrong.
+          await serveError({message: 'Invalid request'}, response, true);
         }
       }
       // Otherwise, if it is a reannotation order:
@@ -798,11 +929,13 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         const answerData = await answer.reannotate(authCode);
         // If the answer data are valid:
         if (answerData.status === 'ok') {
+          await recordMetric('managerActivity', 'reannotate.html', 'ok');
           // Serve the answer page.
           response.end(answerData.answerPage);
         }
         // Otherwise, i.e. if they are invalid:
         else {
+          await recordMetric('managerActivity', 'reannotate.html', 'error');
           // Report the error.
           await serveError({message: answerData.message}, response, true);
         }
@@ -816,11 +949,39 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         const answerData = await answer.renewWCAG(authCode);
         // If the answer data are valid:
         if (answerData.status === 'ok') {
+          await recordMetric('managerActivity', 'renewWCAG.html', 'ok');
+          // Serve the answer page.
+          response.end(answerData.answerPage);
+        }
+        // Otherwise, i.e. if they are invalid:
+        else {
+          await recordMetric('managerActivity', 'renewWCAG.html', 'error');
+          // Report the error.
+          await serveError({message: answerData.message}, response, true);
+        }
+      }
+      // Otherwise, if it is a self-submitting manager page (one page serves the form on
+      // GET and processes its own submission on POST, unlike enqueueForm.html/reannotateForm.html,
+      // whose submissions go to a separate action page):
+      else if (pageName.endsWith('.html') && selfSubmittingManagerPages.has(pageName.slice(0, -5))) {
+        const topic = pageName.slice(0, -5);
+        setHeaders('text/html', pathname, 'ultra');
+        // Reconstruct a query string from the POST body, so the page's answer() function
+        // can read its submitted parameters the same way it reads a GET query string.
+        const search = `?${new URLSearchParams(postData as Record<string, string>).toString()}`;
+        // Get the answer data. The method is passed so the handler only processes a
+        // submission for POST, never for GET, regardless of what its query string contains.
+        const answerData = await answer[topic]!(pathTail, search, method);
+        // If they are valid:
+        if (answerData.status === 'ok') {
+          await recordMetric('managerActivity', topic, 'ok');
+          applySetCookie(answerData);
           // Serve the answer page.
           response.end(answerData.answerPage);
         }
         // Otherwise, i.e. if they are invalid:
         else {
+          await recordMetric('managerActivity', topic, 'error');
           // Report the error.
           await serveError({message: answerData.message}, response, true);
         }
@@ -938,6 +1099,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
           const {description, URL, reason} = postData as {description: string; URL: string; reason: string};
           // Get the response body.
           const responseBody = await apiRespond.requestTest([description, URL, reason]);
+          await recordPageMetric('apiOperations', 'requestTest');
           // Send it.
           setHeaders('application/json', null, 'ultra');
           response.end(JSON.stringify(responseBody));
@@ -947,6 +1109,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
           const {reason} = postData as {reason: string};
           // Get the response body.
           const responseBody = await apiRespond.requestRetest(segments.slice(1).concat(reason));
+          await recordPageMetric('apiOperations', 'requestRetest');
           // Send it.
           setHeaders('application/json', null, 'ultra');
           response.end(JSON.stringify(responseBody));
@@ -956,6 +1119,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
           const {feature} = postData as {feature: string};
           // Get the response body.
           const responseBody = await apiRespond.requestFeature([feature]);
+          await recordPageMetric('apiOperations', 'requestFeature');
           // Send it.
           setHeaders('application/json', null, 'ultra');
           response.end(JSON.stringify(responseBody));

package/linkValidation.test.ts

@@ -55,6 +55,7 @@ const htmlRoutes = [
   '/reannotate.html',
   '/reannotateForm.html',
   '/hideReportForm.html',
+  '/showHiddenReportsForm.html',
   '/unhideReportForm.html',
   '/expungeReportsForm.html',
   '/pruneReportsForm.html',

package/mcp.test.ts

@@ -9,12 +9,26 @@ import {test} from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
 import {mcpPath, createMCPServer, handleMCP} from './mcp.ts';
+import {metricsPath} from './util.ts';
+import fs from 'node:fs';
 
 // CONSTANTS
 
 // Set DB_DIR to the fixture database for all tests.
 process.env.DB_DIR = (await import('./test/dbFixture.ts')).fixtureDBDir;
 
+// FUNCTIONS
+
+// Returns the current count for an MCP tool in the metrics file, or 0 if the file or the
+// tool's entry is absent (the file does not exist until the first metric is recorded).
+const getToolCallCount = (toolName: string): number => {
+  if (!fs.existsSync(metricsPath())) {
+    return 0;
+  }
+  const metrics = JSON.parse(fs.readFileSync(metricsPath(), 'utf8'));
+  return metrics.mcpToolCalls[toolName] ?? 0;
+};
+
 // TESTS
 
 test('mcpPath is /mcp', () => {
@@ -48,14 +62,17 @@ test('each tool has a description and a handler function', () => {
 
 test('listReports handler returns content and structuredContent', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('listReports');
   const result = await (server as any)._registeredTools.listReports.handler({});
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('listReports'), countBefore + 1);
 });
 
 test('listIssues handler returns content and structuredContent for a valid report', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('listIssues');
   const result = await (server as any)._registeredTools.listIssues.handler({
     timeStamp: '260101T0000',
     jobID: 'mix'
@@ -63,10 +80,12 @@ test('listIssues handler returns content and structuredContent for a valid repor
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('listIssues'), countBefore + 1);
 });
 
 test('listViolators handler returns content and structuredContent for a valid issue', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('listViolators');
   const result = await (server as any)._registeredTools.listViolators.handler({
     issueID: 'linkNoText',
     timeStamp: '260101T0000',
@@ -75,10 +94,12 @@ test('listViolators handler returns content and structuredContent for a valid is
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('listViolators'), countBefore + 1);
 });
 
 test('listDiagnoses handler returns content and structuredContent for a valid diagnosis', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('listDiagnoses');
   const result = await (server as any)._registeredTools.listDiagnoses.handler({
     catalogIndex: '0',
     issueID: 'linkNoText',
@@ -88,10 +109,12 @@ test('listDiagnoses handler returns content and structuredContent for a valid di
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('listDiagnoses'), countBefore + 1);
 });
 
 test('getReport handler returns content and structuredContent for a valid report', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('getReport');
   const result = await (server as any)._registeredTools.getReport.handler({
     timeStamp: '260101T0000',
     jobID: 'mix'
@@ -99,10 +122,12 @@ test('getReport handler returns content and structuredContent for a valid report
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('getReport'), countBefore + 1);
 });
 
 test('requestTest handler returns content and structuredContent', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('requestTest');
   const result = await (server as any)._registeredTools.requestTest.handler({
     description: 'Test Page',
     URL: 'https://example.com/test',
@@ -111,10 +136,12 @@ test('requestTest handler returns content and structuredContent', async () => {
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('requestTest'), countBefore + 1);
 });
 
 test('requestRetest handler returns content and structuredContent for a valid report', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('requestRetest');
   const result = await (server as any)._registeredTools.requestRetest.handler({
     timeStamp: '260101T0000',
     jobID: 'mix',
@@ -123,16 +150,19 @@ test('requestRetest handler returns content and structuredContent for a valid re
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('requestRetest'), countBefore + 1);
 });
 
 test('requestFeature handler returns content and structuredContent', async () => {
   const server = createMCPServer();
+  const countBefore = getToolCallCount('requestFeature');
   const result = await (server as any)._registeredTools.requestFeature.handler({
     feature: 'A new feature idea'
   });
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('requestFeature'), countBefore + 1);
 });
 
 test('listIssues handler returns an error for a nonexistent report', async () => {

package/mcp.ts

@@ -17,6 +17,7 @@ import * as requestTestAPI from './api/requestTest.ts';
 import * as requestRetestAPI from './api/requestRetest.ts';
 import * as requestFeatureAPI from './api/requestFeature.ts';
 import {version} from './api/version.ts';
+import {recordMetric} from './util.ts';
 
 import {
   getReportSchema,
@@ -68,6 +69,7 @@ export const createMCPServer = (): McpServer => {
     },
     async () => {
       const result = await listReportsAPI.response();
+      await recordMetric('mcpToolCalls', 'listReports');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -87,6 +89,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({timeStamp, jobID}) => {
       const result = await listIssuesAPI.response([timeStamp, jobID]);
+      await recordMetric('mcpToolCalls', 'listIssues');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -106,6 +109,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({issueID, timeStamp, jobID}) => {
       const result = await listViolatorsAPI.response([issueID, timeStamp, jobID]);
+      await recordMetric('mcpToolCalls', 'listViolators');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -125,6 +129,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({catalogIndex, issueID, timeStamp, jobID}) => {
       const result = await listDiagnosesAPI.response([catalogIndex, issueID, timeStamp, jobID]);
+      await recordMetric('mcpToolCalls', 'listDiagnoses');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -144,6 +149,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({timeStamp, jobID}) => {
       const result = await getReportAPI.response([timeStamp, jobID]);
+      await recordMetric('mcpToolCalls', 'getReport');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -163,6 +169,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({description, URL, reason}) => {
       const result = await requestTestAPI.response([description, URL, reason]);
+      await recordMetric('mcpToolCalls', 'requestTest');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -182,6 +189,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({timeStamp, jobID, reason}) => {
       const result = await requestRetestAPI.response([timeStamp, jobID, reason]);
+      await recordMetric('mcpToolCalls', 'requestRetest');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
@@ -201,6 +209,7 @@ export const createMCPServer = (): McpServer => {
     },
     async ({feature}) => {
       const result = await requestFeatureAPI.response([feature]);
+      await recordMetric('mcpToolCalls', 'requestFeature');
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "48.0.0",
+  "version": "49.0.0",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",

package/smokeTest.ts

@@ -40,13 +40,21 @@ const concretePaths: Record<string, Record<string, string>> = {
   POST: {
     '/api/*': '/api/requestFeature',
     '/mcp': '/mcp',
+    '/ai0BalanceForm.html': '/ai0BalanceForm.html',
+    '/expungeReportsForm.html': '/expungeReportsForm.html',
+    '/hideReportForm.html': '/hideReportForm.html',
+    '/metrics.html': '/metrics.html',
+    '/pruneReportsForm.html': '/pruneReportsForm.html',
+    '/rewindReportsForm.html': '/rewindReportsForm.html',
     '/reannotate.html': '/reannotate.html',
     '/requestAction.html': '/requestAction.html',
     '/renewWCAG.html': '/renewWCAG.html',
     '/requestRetest.html/*': '/requestRetest.html/260101T0001/ct',
     '/requestTest.html': '/requestTest.html',
+    '/showHiddenReportsForm.html': '/showHiddenReportsForm.html',
     '/tutorialAIComment.html': '/tutorialAIComment.html',
     '/tutorialWebComment.html': '/tutorialWebComment.html',
+    '/unhideReportForm.html': '/unhideReportForm.html',
     '/worker/job': '/worker/job',
     '/worker/report': '/worker/report'
   }
@@ -55,6 +63,12 @@ const concretePaths: Record<string, Record<string, string>> = {
 const postBodies: Record<string, object> = {
   '/api/requestFeature': {feature: 'smoke test'},
   '/mcp': {},
+  '/ai0BalanceForm.html': {authCode: 'invalid'},
+  '/expungeReportsForm.html': {authCode: 'invalid'},
+  '/hideReportForm.html': {authCode: 'invalid'},
+  '/metrics.html': {authCode: 'invalid'},
+  '/pruneReportsForm.html': {authCode: 'invalid'},
+  '/rewindReportsForm.html': {authCode: 'invalid'},
   '/reannotate.html': {authCode: 'invalid'},
   '/requestAction.html': {
     target: 'https://smoketest.example.com\tSmoke Test Page', authCode: 'invalid'
@@ -62,7 +76,9 @@ const postBodies: Record<string, object> = {
   '/renewWCAG.html': {authCode: 'invalid'},
   '/requestRetest.html/260101T0001/ct': {why: 'smoke test'},
   '/requestTest.html': {description: 'Smoke Test Page', url: 'https://smoketest.example.com', why: 'smoke test'},
+  '/showHiddenReportsForm.html': {authCode: 'invalid'},
   '/tutorialAIComment.html': {content: 'smoke test'},
+  '/unhideReportForm.html': {authCode: 'invalid'},
   '/tutorialWebComment.html': {content: 'smoke test'},
   '/worker/job': {},
   '/worker/report': {}