@jrpool/kilotest 49.0.0 → 51.1.0

package/api/getReport.ts

@@ -25,7 +25,9 @@ type ResponseContent = z.infer<typeof getReportResponseSchema>['response content
 export const response = async (args: string[]) => {
   const [timeStamp = '', jobID = ''] = args;
   const thisHost = getThisHost();
-  // Get the report size.
+  // Get the report size. A malformed timestamp or job ID resolves to a nonexistent file
+  // path, which getReportStats already reports as unavailable, so no separate syntactic
+  // check is needed here.
   const reportStats = await getReportStats(timeStamp, jobID);
   // Create the response content.
   const responseContent: ResponseContent = reportStats

package/api/requestFeature.test.ts

@@ -7,6 +7,20 @@
 
 import {test, beforeEach, after} from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// Blank the alert configuration unconditionally, before ./requestFeature.ts (which
+// calls sendAlert) is ever imported below, so this file sends no real alert emails
+// even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
+// ENVIRONMENT
+
+const testDir = path.join(import.meta.dirname, '../test/fixtures/featureRequests');
+process.env.FEATURE_REQUESTS_PATH = path.join(testDir, 'featureRequests.json');
 
 // SETUP AND TEARDOWN
 
@@ -14,16 +28,19 @@ let logged: any[] = [];
 const originalLog = console.log;
 
 // Capture console.log so the alert sendAlert emits can be observed. The alert
-// configuration is empty in tests, so sendAlert logs a WARNING instead of sending.
-beforeEach(() => {
+// configuration is blanked above, so sendAlert logs a WARNING instead of sending.
+beforeEach(async () => {
   logged = [];
   console.log = (...args) => logged.push(args.join(' '));
+  await fs.mkdir(testDir, {recursive: true});
+  await fs.writeFile(process.env.FEATURE_REQUESTS_PATH!, '[]\n');
 });
 
 import {response} from './requestFeature.ts';
 
-after(() => {
+after(async () => {
   console.log = originalLog;
+  await fs.rm(testDir, {recursive: true, force: true});
 });
 
 // TESTS
@@ -37,6 +54,24 @@ test('requestFeature rejects an empty feature request', async () => {
   );
 });
 
+test('requestFeature rejects a feature request shorter than 20 characters', async () => {
+  const body = await response(['Too short']);
+  const details = body['response content']['details about your request'] as any;
+  assert.ok(details.error.includes('feature description'));
+  assert.ok(
+    !logged.some(line => line.startsWith('WARNING (Kilotest: MCP feature request received)'))
+  );
+});
+
+test('requestFeature rejects a feature request longer than 1000 characters', async () => {
+  const body = await response(['x'.repeat(1001)]);
+  const details = body['response content']['details about your request'] as any;
+  assert.ok(details.error.includes('feature description'));
+  assert.ok(
+    !logged.some(line => line.startsWith('WARNING (Kilotest: MCP feature request received)'))
+  );
+});
+
 test('requestFeature accepts a non-empty feature request and notifies the manager', async () => {
   const body = await response(['Add a dark mode toggle']);
   const details = body['response content']['details about your request'] as any;
@@ -50,7 +85,68 @@ test('requestFeature accepts a non-empty feature request and notifies the manage
 });
 
 test('requestFeature includes tool name and metadata', async () => {
-  const body = await response(['Some feature']);
+  const body = await response(['A sufficiently long feature description']);
   assert.equal(body['tool name'], 'requestFeature');
   assert.ok(body['response metadata'].identifier);
 });
+
+test('requestFeature records a valid feature request to the feature-requests file', async () => {
+  await response(['Add a dark mode toggle to the reports page']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'Add a dark mode toggle to the reports page');
+  assert.ok(featureRequests[0].timeStamp);
+});
+
+test('requestFeature appends to, rather than overwrites, existing feature requests', async () => {
+  await response(['First feature request of at least 20 characters']);
+  await response(['Second feature request of at least 20 characters']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 2);
+});
+
+test('requestFeature does not record an invalid feature request', async () => {
+  await response(['short']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 0);
+});
+
+test('requestFeature creates the feature-requests file when it does not exist', async () => {
+  await fs.unlink(process.env.FEATURE_REQUESTS_PATH!);
+  await response(['A feature request when no file yet exists']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'A feature request when no file yet exists');
+});
+
+test('requestFeature rejects a feature request identical to one already on file', async () => {
+  const feature = 'Add a dark mode toggle to the reports page';
+  const firstBody = await response([feature]);
+  const firstDetails = firstBody['response content']['details about your request'] as any;
+  assert.equal(firstDetails.error, undefined);
+  const secondBody = await response([feature]);
+  const secondDetails = secondBody['response content']['details about your request'] as any;
+  assert.ok(secondDetails.error.includes('identical to one already submitted'));
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  // The duplicate was not recorded a second time.
+  assert.equal(featureRequests.length, 1);
+});
+
+test('requestFeature does not notify the manager of a duplicate feature request', async () => {
+  const feature = 'Add a dark mode toggle to the settings page';
+  await response([feature]);
+  logged = [];
+  await response([feature]);
+  assert.ok(
+    !logged.some(line => line.startsWith('WARNING (Kilotest: MCP feature request received)'))
+  );
+});
+
+test('requestFeature accepts a feature request that differs from an existing one', async () => {
+  await response(['An existing feature request on file']);
+  const body = await response(['A different feature request entirely']);
+  const details = body['response content']['details about your request'] as any;
+  assert.equal(details.error, undefined);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 2);
+});

package/api/requestFeature.ts

@@ -8,35 +8,79 @@
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
 import {sendAlert} from '../alerts.ts';
+import {checkCommentDuplicate, checkLength, getJSON, getNowStamp} from '../util.ts';
 import {requestFeatureResponseSchema} from './schemas.ts';
+import fs from 'node:fs/promises';
+import path from 'node:path';
 
 // TYPES
 
 // The response content defined by the response schema.
 type ResponseContent = z.infer<typeof requestFeatureResponseSchema>['response content'];
 
+// FUNCTIONS (helpers)
+
+const getFeatureRequestsPath = () => process.env.FEATURE_REQUESTS_PATH || path.join(import.meta.dirname, '../db/featureRequests.json');
+
 // FUNCTIONS
 
 // Returns the response body.
 export const response = async (args: string[]) => {
   const [feature = ''] = args;
   const thisHost = getThisHost();
+  const lengthCheck = checkLength(feature, 20, 1000, 'feature description');
   // Initialize the response content.
-  const responseContent: ResponseContent = {
-    'details about your request': {
-      error: 'request invalid: request is empty'
-    }
-  };
-  // If the requested feature or improvement exists:
-  if (feature) {
-    // Notify the manager.
-    await sendAlert('Kilotest: MCP feature request received', feature);
-    // Add the disposition to the response content.
-    responseContent['details about your request'] = {
-      'date and time received': new Date().toISOString(),
-      disposition: 'received and logged; manager notified'
+  let responseContent: ResponseContent;
+  // If the feature description is invalid:
+  if (lengthCheck.status === 'error') {
+    responseContent = {
+      'details about your request': {
+        error: `request invalid: ${lengthCheck.message}`
+      }
     };
   }
+  // Otherwise, i.e. if it is valid:
+  else {
+    // Get the feature requests already on file.
+    const featureRequestsPath = getFeatureRequestsPath();
+    let featureRequests: {timeStamp: string; content: string}[] = [];
+    try {
+      const existing = await fs.readFile(featureRequestsPath, 'utf8');
+      featureRequests = JSON.parse(existing);
+    }
+    catch {
+      // Initialize an empty feature-requests array.
+    }
+    // If the request is identical to one already on file:
+    const duplicateCheck = checkCommentDuplicate(featureRequests, feature);
+    if (duplicateCheck.status === 'error') {
+      responseContent = {
+        'details about your request': {
+          error: 'request invalid: your feature request is identical to one already submitted, ' +
+            'but you are welcome to submit a different one'
+        }
+      };
+    }
+    // Otherwise, i.e. if it is not a duplicate:
+    else {
+      // Record the feature request alongside the existing ones.
+      featureRequests.push({
+        timeStamp: getNowStamp(),
+        content: feature
+      });
+      await fs.mkdir(path.dirname(featureRequestsPath), {recursive: true});
+      await fs.writeFile(featureRequestsPath, getJSON(featureRequests));
+      // Notify the manager.
+      await sendAlert('Kilotest: MCP feature request received', feature);
+      // Add the disposition to the response content.
+      responseContent = {
+        'details about your request': {
+          'date and time received': new Date().toISOString(),
+          disposition: 'received and logged; manager notified'
+        }
+      };
+    }
+  }
   // Create a response body.
   const body = {
     'tool collection': getToolsFacts(),

package/api/requestRetest.test.ts

@@ -11,15 +11,40 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import {fixtureDBDir} from '../test/dbFixture.ts';
 
+// Blank the alert configuration unconditionally, before ./requestRetest.ts (whose
+// processTestRequest calls sendAlert) is ever imported below, so this file sends no
+// real alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 // SETUP AND TEARDOWN
 
 const savedDBDir = process.env.DB_DIR;
 const testRequestsPath = path.join(fixtureDBDir, 'jobs', 'testRequests.json');
+// A report added only to this test's disposable copy of the fixture database (never to
+// the tracked test/fixtures/db corpus), so its 3-character job ID satisfies isJobID
+// without perturbing report-count tests elsewhere that copy the whole corpus. Its job ID
+// intentionally differs from the tracked corpus's 2-character 260101T0001-ct.json, which
+// isJobID would reject.
+const retestFixturePath = path.join(fixtureDBDir, 'reports', '260101T0003-ret.json');
+const retestFixtureReport = {
+  id: '260101T0003-ret',
+  what: 'Retest Fixture Page',
+  target: {what: 'Retest Fixture Page', url: 'https://example.com/retestfixture'},
+  sources: {worker: 'test-worker'},
+  acts: [],
+  jobData: {startTime: '26-01-01T00:00', endTime: '26-01-01T00:10', elapsedSeconds: 600, preventions: {}, issuelessRules: []},
+  catalog: {},
+  images: {},
+  checkpoints: []
+};
 let logged: any[] = [];
 const originalLog = console.log;
 
-before(() => {
+before(async () => {
   process.env.DB_DIR = fixtureDBDir;
+  await fs.writeFile(retestFixturePath, JSON.stringify(retestFixtureReport));
 });
 
 // Reset the test-requests file and capture console.log, so the alert that
@@ -32,8 +57,9 @@ beforeEach(async () => {
 
 import {response} from './requestRetest.ts';
 
-after(() => {
+after(async () => {
   console.log = originalLog;
+  await fs.unlink(retestFixturePath);
   if (savedDBDir !== undefined) {
     process.env.DB_DIR = savedDBDir;
   }
@@ -45,12 +71,19 @@ after(() => {
 // TESTS
 
 test('requestRetest rejects a nonexistent report', async () => {
-  const body = await response(['999999T9999', 'xyz', 'A reason that is long enough.']);
+  const body = await response(['251231T0000', 'zzz', 'A reason that is long enough.']);
   const details = body['response content']['details about your request'] as any;
   assert.ok(details.error.includes('does not exist'));
   assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
 });
 
+test('requestRetest rejects a malformed timestamp or job identifier', async () => {
+  const body = await response(['999999T9999', 'xyz', 'A reason that is long enough.']);
+  const details = body['response content']['details about your request'] as any;
+  assert.ok(details.error.includes('malformed'));
+  assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
+});
+
 test('requestRetest rejects a superseded report', async () => {
   // 260101T0000-mix is an earlier report of "Mixed Outcomes Page" than 260202T0000-new,
   // so it is superseded and processTestRequest returns 'superseded', reported via the
@@ -66,7 +99,7 @@ test('requestRetest rejects a superseded report', async () => {
 });
 
 test('requestRetest rejects a reason shorter than 20 characters', async () => {
-  const body = await response(['260101T0001', 'ct', 'short']);
+  const body = await response(['260101T0003', 'ret', 'short']);
   const details = body['response content']['details about your request'] as any;
   assert.ok(details.error.includes('reason'));
   assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
@@ -74,20 +107,20 @@ test('requestRetest rejects a reason shorter than 20 characters', async () => {
 
 test('requestRetest rejects a reason longer than 100 characters', async () => {
   const longReason = 'x'.repeat(101);
-  const body = await response(['260101T0001', 'ct', longReason]);
+  const body = await response(['260101T0003', 'ret', longReason]);
   const details = body['response content']['details about your request'] as any;
   assert.ok(details.error.includes('reason'));
   assert.ok(!logged.some(line => line.includes('new retest request awaits approval')));
 });
 
 test('requestRetest rejects a report matching a claimed job by description', async () => {
-  // 260101T0001-ct is the "All CantTell Page" report.
+  // 260101T0003-ret is the "Retest Fixture Page" report.
   const claimedPath = path.join(fixtureDBDir, 'jobs', 'claimed', 'clm.json');
   await fs.writeFile(claimedPath, JSON.stringify({
-    target: {what: 'All CantTell Page', url: 'https://example.com/unrelated'}
+    target: {what: 'Retest Fixture Page', url: 'https://example.com/unrelated'}
   }));
   try {
-    const body = await response(['260101T0001', 'ct', 'A reason that is long enough.']);
+    const body = await response(['260101T0003', 'ret', 'A reason that is long enough.']);
     const details = body['response content']['details about your request'] as any;
     assert.equal(details.error, undefined);
     const disposition = body['response content']['disposition of your request'] as any;
@@ -102,13 +135,13 @@ test('requestRetest rejects a report matching a claimed job by description', asy
 });
 
 test('requestRetest rejects a report matching a queued job by URL', async () => {
-  // 260101T0001-ct's URL is https://example.com/canttell.
+  // 260101T0003-ret's URL is https://example.com/retestfixture.
   const queuedPath = path.join(fixtureDBDir, 'jobs', 'queue', 'que.json');
   await fs.writeFile(queuedPath, JSON.stringify({
-    target: {what: 'Some Other Page', url: 'https://example.com/canttell'}
+    target: {what: 'Some Other Page', url: 'https://example.com/retestfixture'}
   }));
   try {
-    const body = await response(['260101T0001', 'ct', 'A reason that is long enough.']);
+    const body = await response(['260101T0003', 'ret', 'A reason that is long enough.']);
     const details = body['response content']['details about your request'] as any;
     assert.equal(details.error, undefined);
     const disposition = body['response content']['disposition of your request'] as any;
@@ -123,8 +156,8 @@ test('requestRetest rejects a report matching a queued job by URL', async () =>
 });
 
 test('requestRetest rejects a duplicate request', async () => {
-  await response(['260101T0001', 'ct', 'A reason that is long enough.']);
-  const body = await response(['260101T0001', 'ct', 'A reason that is long enough.']);
+  await response(['260101T0003', 'ret', 'A reason that is long enough.']);
+  const body = await response(['260101T0003', 'ret', 'A reason that is long enough.']);
   const details = body['response content']['details about your request'] as any;
   assert.equal(details.error, undefined);
   const disposition = body['response content']['disposition of your request'] as any;

package/api/requestRetest.ts

@@ -7,7 +7,7 @@
 
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
-import {processTestRequest} from '../util.ts';
+import {checkLength, isJobID, isTimeStamp, processTestRequest} from '../util.ts';
 import {requestRetestResponseSchema} from './schemas.ts';
 
 // TYPES
@@ -21,14 +21,20 @@ type ResponseContent = z.infer<typeof requestRetestResponseSchema>['response con
 export const response = async (args: string[]) => {
   const [timeStamp = '', jobID = '', reason = ''] = args;
   const thisHost = getThisHost();
-  const reasonLength = reason.length;
+  const reasonCheck = checkLength(reason, 20, 100, 'reason');
   // Initialize the response-content properties.
   let requestDetails: ResponseContent['details about your request'];
   let requestDisposition: ResponseContent['disposition of your request'] = null;
-  // If the encoded reason is too short or too long:
-  if (reasonLength < 20 || reasonLength > 100) {
+  // If the timestamp or job ID is not syntactically valid:
+  if (!isTimeStamp(timeStamp) || !isJobID(jobID)) {
     requestDetails = {
-      error: 'request invalid: your reason is not between 20 and 100 characters long'
+      error: 'request invalid: the report timestamp or job identifier is malformed'
+    };
+  }
+  // Otherwise, if the encoded reason is too short or too long:
+  else if (reasonCheck.status === 'error') {
+    requestDetails = {
+      error: `request invalid: your ${reasonCheck.message}`
     }
   }
   // Otherwise, i.e. if the request is facially valid:

package/api/requestTest.test.ts

@@ -11,6 +11,13 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import {fixtureDBDir} from '../test/dbFixture.ts';
 
+// Blank the alert configuration unconditionally, before ./requestTest.ts (whose
+// processTestRequest calls sendAlert) is ever imported below, so this file sends no
+// real alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 // SETUP AND TEARDOWN
 
 const savedDBDir = process.env.DB_DIR;

package/api/requestTest.ts

@@ -7,7 +7,7 @@
 
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
-import {isURL, processTestRequest} from '../util.ts';
+import {checkLength, isURL, processTestRequest} from '../util.ts';
 import {requestTestResponseSchema} from './schemas.ts';
 
 // TYPES
@@ -24,14 +24,14 @@ export const response = async (args: string[]) => {
   // Initialize the response-content properties.
   let requestDetails: ResponseContent['details about your request'];
   let requestDisposition: ResponseContent['disposition of your request'] = null;
-  const descriptionLength = description.length;
-  // If the description is empty or too long:
-  if (!descriptionLength || descriptionLength > 100) {
+  const descriptionCheck = checkLength(description, 1, 100, 'description of the page');
+  // If the description is invalid:
+  if (descriptionCheck.status === 'error') {
     requestDetails = {
-      error: 'request invalid: your description of the page is not between 1 and 100 characters long'
+      error: `request invalid: your ${descriptionCheck.message}`
     };
   }
-  // Otherwise, i.e. if the URL is too short or too long::
+  // Otherwise, i.e. if the URL is too short or too long:
   else if (url.length < 12 || url.length > 300) {
     requestDetails = {
       error: 'request invalid: you specified a URL for the page that is not between 12 and 300 characters long'

package/api/schemas.ts

@@ -43,7 +43,7 @@ export const getReportSchema = {
 
 // requestTest: POST /api/requestTest
 export const requestTestSchema = {
-  description: z.string().describe('10- to 100-character description of the page conforming to the naming convention used in the listReports output'),
+  description: z.string().describe('1- to 100-character description of the page conforming to the naming convention used in the listReports output'),
   URL: z.string().describe('12- to 300-character URL of the page, including the https:// scheme and any query'),
   reason: z.string().describe('20- to 100-character reason why the page should be tested')
 };
@@ -57,7 +57,7 @@ export const requestRetestSchema = {
 
 // requestFeature: POST /api/requestFeature
 export const requestFeatureSchema = {
-  feature: z.string().describe('description of requested feature improvement or new feature')
+  feature: z.string().describe('20- to 1000-character description of requested feature improvement or new feature')
 };
 
 // listReports takes no input; omitted (mcp.ts already uses inputSchema: {}).

package/api/util.test.ts

@@ -7,6 +7,15 @@
 
 import {test} from 'node:test';
 import assert from 'node:assert/strict';
+
+// Blank the alert configuration unconditionally, before ../util.ts (which
+// processTestRequest calls sendAlert from) is ever imported below, so this file sends
+// no real alert emails even when run directly (e.g. `npx tsx --test api/util.test.ts`)
+// rather than via `npm test`, which normally guards against this via test/setup.ts.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 import {getReportBasics, getResponseMetadata, getRuleEngineFacts, getRuleEnginesFacts, getIssueSpec, getToolsFacts} from './util.ts';
 import {processTestRequest} from '../util.ts';
 

package/apiIntegration.test.ts

@@ -8,19 +8,29 @@
 import {test, before, after} from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import {requestHandler} from './index.ts';
 
 // CONSTANTS
 
 const port = 3998;
+const featureRequestsPath = path.join(import.meta.dirname, 'test/fixtures/apiIntegration/featureRequests.json');
 
 // SETUP AND TEARDOWN
 
 const savedDBDir = process.env.DB_DIR;
+const savedFeatureRequestsPath = process.env.FEATURE_REQUESTS_PATH;
 let server: http.Server;
 
 before(async () => {
   process.env.DB_DIR = (await import('./test/dbFixture.ts')).fixtureDBDir;
+  // Use a fixture path, rather than the real default, for feature requests, so this
+  // test's submission neither pollutes real data nor is rejected as a duplicate of
+  // whatever a prior run of this same test already left on disk.
+  process.env.FEATURE_REQUESTS_PATH = featureRequestsPath;
+  await fs.mkdir(path.dirname(featureRequestsPath), {recursive: true});
+  await fs.writeFile(featureRequestsPath, '[]\n');
   server = http.createServer(requestHandler);
   await new Promise<void>(resolve => server.listen(port, () => resolve()));
 });
@@ -32,6 +42,13 @@ after(async () => {
   else {
     delete process.env.DB_DIR;
   }
+  if (savedFeatureRequestsPath !== undefined) {
+    process.env.FEATURE_REQUESTS_PATH = savedFeatureRequestsPath;
+  }
+  else {
+    delete process.env.FEATURE_REQUESTS_PATH;
+  }
+  await fs.rm(path.dirname(featureRequestsPath), {recursive: true, force: true});
   server.closeAllConnections?.();
   await new Promise<void>(resolve => {
     const timer = setTimeout(() => {

package/docs/BACKLOG.md

@@ -4,9 +4,21 @@ Engineering tasks and risks that are not yet scheduled.
 
 Items marked completed or not adopted are preserved for about 2 weeks in case of production bugs.
 
-## Make validation locations consistent
+## Make validation locations consistent (completed)
 
-Inventory where request validations occur, e.g. in `index.ts` versus in the modules to which it routes requests. Find any arbitrary inconsistencies in the locations. If any are found, decide where it is most parsimonious and maintainable for the validation to take place and standardize on that.
+Inventory where request validations occur, e.g. in `index.ts` versus in the modules to which it routes requests. Find any arbitrary inconsistencies in the locations. If any are found, decide where it is most parsimonious and maintainable for the validation to take place and, when the user approves, standardize on that.
+
+### Inventory findings
+
+Validation was spread across `index.ts`, the `web/*` modules it dispatches to, and the `api/*.ts` modules shared by the HTTP API and the MCP tools (`mcp.ts` itself performs no validation; it delegates entirely to `api/*.ts`, whose zod `inputSchema`s in `api/schemas.ts` are shape-only, documenting length/format bounds in `.describe()` prose rather than enforcing them). Several arbitrary inconsistencies were found and fixed:
+
+- **A URL was validated three different, inconsistent ways** for what is logically the same field: a loose inline `url.startsWith('https://')` check in `index.ts` (for both `requestTest.html` and `requestAction.html`), and the correct, stricter shared `isURL()` helper (already used by `api/requestTest.ts` and `web/enqueue/index.ts`) nowhere in `index.ts` itself. Fixed by having `index.ts` call `isURL()` at both sites.
+- **`requestAction.html`'s URL and authorization code were validated twice**: once in `index.ts` before dispatch, and again inside `web/enqueue/index.ts`'s own `answer()`, using different strictness for the URL check. Once both checks used the same `isURL()`/`isValidAuthCode()` helpers, the inner check in `enqueue` became strictly unreachable-as-false (its only caller, `index.ts`, already guarantees both conditions), so it was removed; `enqueue` now trusts its caller, consistent with `web/requestTest/` and `web/requestRetest/`.
+- **The authorization-code check (`authCode === process.env.AUTH_CODE`) was copy-pasted verbatim across 8 separate modules** (`hideReportForm`, `unhideReportForm`, `ai0BalanceForm`, `showHiddenReportsForm`, `metrics`, `renewWCAG`, `reannotate`, and, via the already-shared `web/reportDeletion.ts`, `pruneReportsForm`/`expungeReportsForm`/`rewindReportsForm`). Consolidated into one shared `isValidAuthCode()` helper in `util.ts`, called everywhere the check occurs.
+- **`api/requestRetest.ts` never validated `timeStamp`/`jobID` syntactically**, unlike the equivalent web path (`index.ts`, `requestRetest.html`) and the equivalent worker path, both of which call `isTimeStamp`/`isJobID` before proceeding; it relied solely on the report lookup failing gracefully. Added the same `isTimeStamp`/`isJobID` pre-check, matching the web path, with its own dedicated (non-corpus) test fixture since the shared 2-character fixture job IDs used elsewhere in the test suite do not satisfy the real, production 3-character job ID format `isJobID` enforces.
+- **`api/requestFeature.ts` had no length bound at all** (only a truthiness check), unlike every other free-text field in the codebase (comments: 20-1000 characters; `reason`/`why`: 20-100). Added a matching 20-1000 character bound via a new, generic `checkLength()` helper (generalized from the existing `checkCommentLength()`, which was already comment-specific and left unchanged), and corrected `api/schemas.ts`'s description accordingly.
+- **A documentation/code mismatch**: `api/schemas.ts` described `requestTest`'s `description` field as "10- to 100-character" while the code actually enforced (and still enforces) 1-100. Corrected the description to match the code's real, existing behavior.
+- **`api/getReport.ts`, `api/listIssues.ts`, `api/listViolators.ts`, `api/listDiagnoses.ts` perform no syntactic validation of `timeStamp`/`jobID`/`issueID`/`catalogIndex`**, unlike routes elsewhere that call `isTimeStamp`/`isJobID` before proceeding. Investigated as a candidate gap, but not changed: these four read-only operations resolve straight to a file-path lookup (`getReport`/`getReportStats`) that already fails gracefully for any malformed or nonexistent input, so a syntactic pre-check would produce an identical outcome through a different code path, with no functional benefit. This is a legitimate, already-consistent "fail-on-use" validation strategy for pure lookups, distinct from (and not required to match) the "fail-fast" strategy used for mutating requests elsewhere.
 
 ## Protect hidden report list (completed)