@jrpool/kilotest 52.0.0 → 55.0.0

package/mcp.ts

@@ -41,8 +41,28 @@ import {
 
 export const mcpPath = '/mcp';
 
+// Shared statement of the Kilotest domain and data hierarchy, repeated in every tool
+// description, in the server instructions, and in the getKilotestOverview tool description,
+// because some MCP clients do not propagate server-level instructions or the server
+// description to their models.
+const sharedContext = 'Kilotest tests web pages for front-end quality (accessibility, usability, and standards conformity); results are organized as report, then issue, then violator element, then diagnosis.';
+
+// Detailed overview of the Kilotest domain, data hierarchy, and tool workflow, returned by
+// the getKilotestOverview tool and served as the docs://kilotest/overview resource.
+const kilotestOverview = [
+  'Kilotest tests web pages for front-end quality: accessibility, usability, and standards conformity.',
+  'Kilotest integrates an ensemble of twelve independent rule engines to test a web page and stores the results as a structured report.',
+  'Results are organized as a hierarchy. A report contains issues. An issue has violators: elements of the tested page reported as exhibiting the issue. A violator has diagnoses: explanations from rule engines of how the element exhibited the issue.',
+  'Typical workflow: call the listReports tool to learn whether a report about the page already exists. If it does, drill down with the listIssues, listViolators, and listDiagnoses tools, or retrieve the entire report with the getReport tool. If no report exists, request a test with the requestTest tool. If the latest report is obsolete, request a retest with the requestRetest tool.',
+  'More documentation is available at https://kilotest.com/llms.txt and https://kilotest.com/llms-full.txt.'
+].join('\n\n');
+
 // FUNCTIONS
 
+// Returns a tool description consisting of the tool-specific summary followed by the shared
+// Kilotest domain context.
+const toolDoc = (summary: string): string => `${summary} ${sharedContext}`;
+
 // Creates and returns an McpServer with Kilotest tools registered.
 export const createMCPServer = (): McpServer => {
   const server = new McpServer({
@@ -51,16 +71,34 @@ export const createMCPServer = (): McpServer => {
     description: 'Tools that test web pages for front-end quality (accessibility, usability, and standards conformity) and make test results available'
   },
   {
-    instructions: 'Use the listReports tool to start. If it shows that there is a report available about the page you want facts about, drill down with the listIssues, listViolators, and listDiagnoses tools. If not, use the requestTest tool to request that the page be tested. If the latest report about the page is obsolete, use the requestRetest tool to request that the page be retested.'
+    instructions: `${sharedContext} Use the listReports tool to start. If it shows that there is a report available about the page you want facts about, drill down with the listIssues, listViolators, and listDiagnoses tools. If not, use the requestTest tool to request that the page be tested. If the latest report about the page is obsolete, use the requestRetest tool to request that the page be retested. For detailed documentation, call the getKilotestOverview tool.`
   });
+  server.registerTool(
+    'getKilotestOverview',
+    {
+      description: toolDoc('Explain what Kilotest is, what its tools do, and how its results are structured.'),
+      inputSchema: {},
+      annotations: {
+        title: toolDoc('Explain what Kilotest is, what its tools do, and how its results are structured.'),
+        readOnlyHint: true,
+        idempotentHint: true,
+        destructiveHint: false,
+        openWorldHint: false
+      }
+    },
+    async () => {
+      await recordMetric('mcpToolCalls', 'getKilotestOverview');
+      return {content: [{type: 'text', text: kilotestOverview}]};
+    }
+  );
   server.registerTool(
     'listReports',
     {
-      description: 'Provide basics about all available reports.',
+      description: toolDoc('Provide basics about all available reports.'),
       inputSchema: {},
       outputSchema: listReportsResponseSchema,
       annotations: {
-        title: 'Provide basics about all available reports.',
+        title: toolDoc('Provide basics about all available reports.'),
         readOnlyHint: true,
         idempotentHint: true,
         destructiveHint: false,
@@ -76,11 +114,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'listIssues',
     {
-      description: 'Provide details about one report, including basics about the issues reported in it.',
+      description: toolDoc('Provide details about one report, including basics about the issues reported in it.'),
       inputSchema: listIssuesSchema,
       outputSchema: listIssuesResponseSchema,
       annotations: {
-        title: 'Provide details about one report, including basics about the issues reported in it.',
+        title: toolDoc('Provide details about one report, including basics about the issues reported in it.'),
         readOnlyHint: true,
         idempotentHint: true,
         destructiveHint: false,
@@ -96,11 +134,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'listViolators',
     {
-      description: 'Provide details about one issue in one report, including basics about the elements of the tested page that were reported as exhibiting the issue.',
+      description: toolDoc('Provide details about one issue in one report, including basics about the elements of the tested page that were reported as exhibiting the issue.'),
       inputSchema: listViolatorsSchema,
       outputSchema: listViolatorsResponseSchema,
       annotations: {
-        title: 'Provide details about one issue in one report, including basics about the elements of the tested page that were reported as exhibiting the issue.',
+        title: toolDoc('Provide details about one issue in one report, including basics about the elements of the tested page that were reported as exhibiting the issue.'),
         readOnlyHint: true,
         idempotentHint: true,
         destructiveHint: false,
@@ -116,11 +154,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'listDiagnoses',
     {
-      description: 'Provide details about one element reported as exhibiting one issue in one report, including the diagnoses provided by rule engines about how the element exhibited the issue.',
+      description: toolDoc('Provide details about one element reported as exhibiting one issue in one report, including the diagnoses provided by rule engines about how the element exhibited the issue.'),
       inputSchema: listDiagnosesSchema,
       outputSchema: listDiagnosesResponseSchema,
       annotations: {
-        title: 'Provide details about one element reported as exhibiting one issue in one report, including the diagnoses provided by rule engines about how the element exhibited the issue.',
+        title: toolDoc('Provide details about one element reported as exhibiting one issue in one report, including the diagnoses provided by rule engines about how the element exhibited the issue.'),
         readOnlyHint: true,
         idempotentHint: true,
         destructiveHint: false,
@@ -136,11 +174,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'getReport',
     {
-      description: 'Get one full report in JSON.',
+      description: toolDoc('Get one full report in JSON.'),
       inputSchema: getReportSchema,
       outputSchema: getReportResponseSchema,
       annotations: {
-        title: 'Get one full report in JSON.',
+        title: toolDoc('Get one full report in JSON.'),
         readOnlyHint: true,
         idempotentHint: true,
         destructiveHint: false,
@@ -156,11 +194,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'requestTest',
     {
-      description: 'Process my request to test a page about which no report is available yet.',
+      description: toolDoc('Process my request to test a page about which no report is available yet.'),
       inputSchema: requestTestSchema,
       outputSchema: requestTestResponseSchema,
       annotations: {
-        title: 'Process my request to test a page about which no report is available yet.',
+        title: toolDoc('Process my request to test a page about which no report is available yet.'),
         readOnlyHint: false,
         idempotentHint: false,
         destructiveHint: false,
@@ -176,11 +214,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'requestRetest',
     {
-      description: 'Process my request to retest a page about which a report is available.',
+      description: toolDoc('Process my request to retest a page about which a report is available.'),
       inputSchema: requestRetestSchema,
       outputSchema: requestRetestResponseSchema,
       annotations: {
-        title: 'Process my request to retest a page about which a report is available.',
+        title: toolDoc('Process my request to retest a page about which a report is available.'),
         readOnlyHint: false,
         idempotentHint: false,
         destructiveHint: false,
@@ -196,11 +234,11 @@ export const createMCPServer = (): McpServer => {
   server.registerTool(
     'requestFeature',
     {
-      description: 'Process my request to add or improve a feature.',
+      description: toolDoc('Process my request to add or improve a feature.'),
       inputSchema: requestFeatureSchema,
       outputSchema: requestFeatureResponseSchema,
       annotations: {
-        title: 'Process my request to add or improve a feature.',
+        title: toolDoc('Process my request to add or improve a feature.'),
         readOnlyHint: false,
         idempotentHint: false,
         destructiveHint: false,
@@ -213,6 +251,18 @@ export const createMCPServer = (): McpServer => {
       return {content: [{type: 'text', text: JSON.stringify(result)}], structuredContent: result};
     }
   );
+  server.registerResource(
+    'kilotest-overview',
+    'docs://kilotest/overview',
+    {
+      title: 'Kilotest overview',
+      description: `What Kilotest is and how its tools and results are organized. ${sharedContext}`,
+      mimeType: 'text/plain'
+    },
+    async () => ({
+      contents: [{uri: 'docs://kilotest/overview', mimeType: 'text/plain', text: kilotestOverview}]
+    })
+  );
   return server;
 };
 // Handles an MCP request.

package/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Kilotest API
-  description: 'Kilotest is an ensemble testing and reporting service for front-end web quality. It uses an ensemble of 12 rule engines to test public web pages for front-end quality (accessibility, usability, and standards conformity). Kilotest acts as a web server for human users, an MCP server for AI platforms, and an API for programmatic access. With this API you can request that a page be tested or retested, discover available reports, incrementally retrieve facts from a report: from what reports are available, to what issues were reported in one report, to what elements violated one issue, to what diagnoses rule engines gave for one violation.'
+  description: 'Kilotest is an ensemble testing and reporting service for front-end web quality. It uses an ensemble of 12 rule engines to test web pages for front-end quality (accessibility, usability, and standards conformity). Kilotest acts as a web server for human users, an MCP server for AI platforms, and an API for programmatic access. With this API you can request that a page be tested or retested, discover available reports, incrementally retrieve facts from a report: from what reports are available, to what issues were reported in one report, to what elements violated one issue, to what diagnoses rule engines gave for one violation.'
   version: 2.1.0
   license:
     name: MIT
@@ -822,7 +822,7 @@ paths:
               properties:
                 description:
                   type: string
-                  description: 10- to 100-character description of the page conforming to the naming convention used in the listReports output
+                  description: 1- to 100-character description of the page conforming to the naming convention used in the listReports output
                 URL:
                   type: string
                   description: 12- to 300-character URL of the page, including the https:// scheme and any query
@@ -860,7 +860,7 @@ paths:
                         properties:
                           description:
                             type: string
-                            description: 10- to 100-character description of the page conforming to the naming convention used in the listReports output
+                            description: 1- to 100-character description of the page conforming to the naming convention used in the listReports output
                           URL:
                             type: string
                             description: 12- to 300-character URL of the page, including the https:// scheme and any query
@@ -1099,7 +1099,7 @@ paths:
               properties:
                 feature:
                   type: string
-                  description: description of requested feature improvement or new feature
+                  description: 20- to 1000-character description of requested feature improvement or new feature
               required:
                 - feature
       responses:
@@ -1129,7 +1129,7 @@ paths:
                         properties:
                           feature:
                             type: string
-                            description: description of requested feature improvement or new feature
+                            description: 20- to 1000-character description of requested feature improvement or new feature
                         required:
                           - feature
                         additionalProperties: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "52.0.0",
+  "version": "55.0.0",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",
@@ -38,6 +38,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "*",
     "dotenv": "*",
+    "ipaddr.js": "*",
     "testaro-issues": "*",
     "zod": "*"
   },

package/scripts/generate-openapi.ts

@@ -58,7 +58,7 @@ const generate = () => {
     openapi: '3.1.0',
     info: {
       title: 'Kilotest API',
-      description: 'Kilotest is an ensemble testing and reporting service for front-end web quality. It uses an ensemble of 12 rule engines to test public web pages for front-end quality (accessibility, usability, and standards conformity). Kilotest acts as a web server for human users, an MCP server for AI platforms, and an API for programmatic access. With this API you can request that a page be tested or retested, discover available reports, incrementally retrieve facts from a report: from what reports are available, to what issues were reported in one report, to what elements violated one issue, to what diagnoses rule engines gave for one violation.',
+      description: 'Kilotest is an ensemble testing and reporting service for front-end web quality. It uses an ensemble of 12 rule engines to test web pages for front-end quality (accessibility, usability, and standards conformity). Kilotest acts as a web server for human users, an MCP server for AI platforms, and an API for programmatic access. With this API you can request that a page be tested or retested, discover available reports, incrementally retrieve facts from a report: from what reports are available, to what issues were reported in one report, to what elements violated one issue, to what diagnoses rule engines gave for one violation.',
       version,
       license: {
         name: license,

package/util.test.ts

@@ -26,12 +26,14 @@ import {
   checkLength,
   createLock,
   dbPath,
+  describeMax,
   getAgoDays,
   getAgoString,
   getCountString,
   getDateString,
   getDateTime,
   getEngineNamesString,
+  getEnvMax,
   getIssue,
   errorMessage,
   getJSON,
@@ -52,6 +54,7 @@ import {
   getWeightName,
   hiddenReportsPath,
   htmlSafe,
+  isAllowedRedirectTarget,
   isAllowedReport,
   isAllowedTarget,
   isJobID,
@@ -268,6 +271,46 @@ test('getDateTime returns null for an invalid time stamp', () => {
   assert.equal(getDateTime('invalid'), null);
 });
 
+test('getEnvMax returns the default when the variable is unset', () => {
+  delete process.env.TEST_ENV_MAX_VAR;
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+});
+
+test('getEnvMax returns the default when the variable is empty', () => {
+  process.env.TEST_ENV_MAX_VAR = '';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns the configured value when it is a positive integer', () => {
+  process.env.TEST_ENV_MAX_VAR = '50';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 50);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns the default when the variable is not an integer', () => {
+  process.env.TEST_ENV_MAX_VAR = 'not-a-number';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns 0 when the variable is explicitly 0, meaning no limit', () => {
+  process.env.TEST_ENV_MAX_VAR = '0';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 0);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns the default when the variable is negative', () => {
+  process.env.TEST_ENV_MAX_VAR = '-5';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('describeMax returns "no limit" for a cap of 0 and the number otherwise', () => {
+  assert.equal(describeMax(0), 'no limit');
+  assert.equal(describeMax(20), '20');
+});
+
 test('getIssue returns an issue ID for a known engine and rule', () => {
   const issueID = getIssue('axe', 'link-name');
   assert.ok(typeof issueID === 'string' || issueID === null);
@@ -451,6 +494,66 @@ test('isAllowedTarget returns true for a URL resolving to a public IPv6 address'
   assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2606:2800:220:1:248:1893:25c8:1946')), true);
 });
 
+test('isAllowedTarget returns false for a URL resolving to a TEST-NET-1 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('192.0.2.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a TEST-NET-2 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('198.51.100.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a TEST-NET-3 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('203.0.113.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a benchmarking (198.18/15) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('198.18.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a reserved 240/4 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('240.0.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to the broadcast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('255.255.255.255')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a multicast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('224.0.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a deprecated IPv6 site-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('fec0::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 multicast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('ff02::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a 6to4 (2002::/16) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2002::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a Teredo (2001::/32) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2001::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an NAT64 (64:ff9b::/96) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('64:ff9b::10.0.0.5')), false);
+});
+
 test('isAllowedTarget returns false for a URL resolving to an address family net.isIP does not recognize', async () => {
   delete process.env.ALLOW_INTERNAL_TARGETS;
   assert.equal(await isAllowedTarget('https://example.com/page', async () => [{address: 'not-an-ip', family: 0}]), false);
@@ -482,6 +585,118 @@ test('isAllowedTarget returns true for a private-address target when ALLOW_INTER
   assert.equal(await isAllowedTarget('https://192.168.1.1/page'), true);
 });
 
+// A fake fetch that returns a response whose url reflects any redirect,
+// so isAllowedRedirectTarget tests need no real network access.
+const fakeFetch = (finalURL: string) => async () => ({url: finalURL}) as Response;
+
+test('isAllowedRedirectTarget returns true when the final URL resolves to a public address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://example.com/page'), fakeLookup('93.184.216.34')),
+    true
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a private address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://10.0.0.5/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when the fetch throws', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const fetchImpl = async () => { throw new Error('fetch failed'); };
+  assert.equal(await isAllowedRedirectTarget('https://example.com/page', fetchImpl), false);
+});
+
+test('isAllowedRedirectTarget returns true for any URL when ALLOW_INTERNAL_TARGETS is true, without fetching', async () => {
+  process.env.ALLOW_INTERNAL_TARGETS = 'true';
+  const fetchImpl = async () => { throw new Error('fetch should not be called'); };
+  assert.equal(await isAllowedRedirectTarget('https://192.168.1.1/page', fetchImpl), true);
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a TEST-NET-1 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://192.0.2.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a TEST-NET-2 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://198.51.100.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a TEST-NET-3 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://203.0.113.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a benchmarking (198.18/15) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://198.18.0.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a reserved 240/4 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://240.0.0.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to the broadcast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://255.255.255.255/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a multicast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://224.0.0.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a deprecated IPv6 site-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://[fec0::1]/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a 6to4 (2002::/16) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://[2002::1]/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a Teredo (2001::/32) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://[2001::1]/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
 test('isAllowedReport returns true when every act has a public actualURL', async () => {
   delete process.env.ALLOW_INTERNAL_TARGETS;
   const report = {
@@ -681,6 +896,63 @@ test('processTestRequest returns a retest error when a report already exists for
   assert.equal(result, 'retest');
 });
 
+test('processTestRequest returns a queueFull error once the pending-request queue is full', {timeout: 500}, async () => {
+  // Fill testRequests.json with 20 pending requests, all for the same URL, so the total
+  // pending count (summed across all URLs' request arrays) reaches the cap directly,
+  // without needing 20 distinct URLs.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: getNowStamp(), description: `Filler Page ${i}`, reason: 'because filler'
+  }));
+  await fs.writeFile(testRequestsPath(), getJSON({'https://example.com/filler': filler}));
+  // A further, distinct request is rejected as queueFull.
+  const {result} = await processTestRequest(
+    'because accessibility', {description: 'One Too Many Page', url: 'https://example.com/one-too-many'}
+  );
+  assert.equal(result, 'queueFull');
+  // Clean up testRequests.json.
+  await fs.writeFile(testRequestsPath(), '{}\n');
+});
+
+test('processTestRequest honors TEST_REQUEST_QUEUE_MAX when the cap is reached below the default', {timeout: 500}, async () => {
+  // With the cap lowered to 2, a single pending request already fills the queue.
+  process.env.TEST_REQUEST_QUEUE_MAX = '2';
+  try {
+    await fs.writeFile(testRequestsPath(), getJSON({
+      'https://example.com/filler': [
+        {timeStamp: getNowStamp(), description: 'Filler Page A', reason: 'because filler'},
+        {timeStamp: getNowStamp(), description: 'Filler Page B', reason: 'because filler'}
+      ]
+    }));
+    const {result} = await processTestRequest(
+      'because accessibility', {description: 'One Too Many Page', url: 'https://example.com/one-too-many'}
+    );
+    assert.equal(result, 'queueFull');
+  }
+  finally {
+    delete process.env.TEST_REQUEST_QUEUE_MAX;
+    await fs.writeFile(testRequestsPath(), '{}\n');
+  }
+});
+
+test('processTestRequest never returns queueFull when TEST_REQUEST_QUEUE_MAX is 0 (no limit)', {timeout: 500}, async () => {
+  // With the cap set to 0, a queue already past the default size is still not full.
+  process.env.TEST_REQUEST_QUEUE_MAX = '0';
+  try {
+    const filler = Array.from({length: 25}, (_, i) => ({
+      timeStamp: getNowStamp(), description: `Filler Page ${i}`, reason: 'because filler'
+    }));
+    await fs.writeFile(testRequestsPath(), getJSON({'https://example.com/filler': filler}));
+    const {result} = await processTestRequest(
+      'because accessibility', {description: 'One More Page', url: 'https://example.com/one-more'}
+    );
+    assert.equal(result, 'ok');
+  }
+  finally {
+    delete process.env.TEST_REQUEST_QUEUE_MAX;
+    await fs.writeFile(testRequestsPath(), '{}\n');
+  }
+});
+
 test('annotateReportObject annotates a report object in place without reading or writing a file', async () => {
   // A report object that was never written to disk (e.g. one just received from a worker,
   // as in index.ts's worker/report handler, which annotates before the first write).