@jshookmcp/jshook 0.1.7 → 0.1.9

package/dist/tests/server/domains/workflow/batch-register.test.js

@@ -0,0 +1,158 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { WorkflowHandlersBatch } from '../../../../src/server/domains/workflow/handlers.impl.workflow-batch.js';
+function parseJson(response) {
+    return JSON.parse(response.content[0].text);
+}
+class TestBatchHandler extends WorkflowHandlersBatch {
+    mockRegisterFn = vi.fn();
+    constructor() {
+        const deps = {
+            browserHandlers: { handlePageEvaluate: vi.fn(), handlePageNavigate: vi.fn(), handleNetworkGetRequests: vi.fn() },
+            advancedHandlers: {
+                handleNetworkEnable: vi.fn().mockResolvedValue({}),
+                handleNetworkDisable: vi.fn().mockResolvedValue({}),
+            },
+        };
+        super(deps);
+        this.mockRegisterFn.mockResolvedValue({
+            content: [{ text: JSON.stringify({ success: true, registered: true }) }],
+        });
+    }
+    async handleRegisterAccountFlow(args) {
+        return this.mockRegisterFn(args);
+    }
+}
+describe('WorkflowHandlersBatch.handleBatchRegister', () => {
+    let handler;
+    beforeEach(() => {
+        handler = new TestBatchHandler();
+    });
+    it('requires registerUrl and accounts', async () => {
+        const result = parseJson(await handler.handleBatchRegister({}));
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('registerUrl');
+    });
+    it('requires non-empty accounts array', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [],
+        }));
+        expect(result.success).toBe(false);
+    });
+    it('caps accounts at MAX_ACCOUNTS=50', async () => {
+        const accounts = Array.from({ length: 100 }, (_, i) => ({
+            fields: { email: `user${i}@test.com`, password: 'pw' },
+        }));
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts,
+        }));
+        expect(result.summary.total).toBe(50);
+        expect(result.summary.truncated).toEqual({ original: 100, limit: 50 });
+    });
+    it('clamps maxConcurrency to 1 (MAX_CONCURRENCY)', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [{ fields: { email: 'a@b.com', password: 'pw' } }],
+            maxConcurrency: 10,
+        }));
+        expect(result.success).toBe(true);
+    });
+    it('clamps maxRetries to [0, 3]', async () => {
+        handler.mockRegisterFn.mockRejectedValue(new Error('fail'));
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [{ fields: { email: 'a@b.com', password: 'pw' } }],
+            maxRetries: 100,
+            retryBackoffMs: 0,
+        }));
+        expect(result.results[0].attempts).toBeLessThanOrEqual(4);
+    });
+    it('clamps timeoutPerAccountMs to [5000, 300000]', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [{ fields: { email: 'a@b.com', password: 'pw' } }],
+            timeoutPerAccountMs: 999999,
+        }));
+        expect(result.success).toBe(true);
+    });
+    it('masks idempotent keys in output (PII protection)', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [{ fields: { email: 'longuser@example.com', password: 'pw' } }],
+        }));
+        const key = result.results[0].idempotentKey;
+        expect(key).toContain('***');
+        expect(key).not.toBe('longuser@example.com');
+        expect(key.startsWith('lo')).toBe(true);
+        expect(key.endsWith('om')).toBe(true);
+    });
+    it('masks short keys appropriately', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [{ fields: { email: 'ab', password: 'pw' } }],
+        }));
+        const key = result.results[0].idempotentKey;
+        expect(key).toContain('***');
+    });
+    it('skips duplicate accounts (idempotency)', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [
+                { fields: { email: 'same@test.com', password: 'pw' } },
+                { fields: { email: 'same@test.com', password: 'pw' } },
+            ],
+        }));
+        expect(result.summary.total).toBe(2);
+        const skipped = result.results.filter((r) => r.result?.skipped);
+        expect(skipped.length).toBe(1);
+        expect(result.summary.skipped).toBe(1);
+    });
+    it('reports all success when all accounts succeed', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [
+                { fields: { email: 'a@b.com', password: 'pw' } },
+                { fields: { email: 'c@d.com', password: 'pw' } },
+            ],
+        }));
+        expect(result.success).toBe(true);
+        expect(result.summary.succeeded).toBe(2);
+        expect(result.summary.failed).toBe(0);
+    });
+    it('reports failure when any account fails', async () => {
+        handler.mockRegisterFn
+            .mockResolvedValueOnce({ content: [{ text: JSON.stringify({ success: true }) }] })
+            .mockRejectedValueOnce(new Error('registration failed'));
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [
+                { fields: { email: 'ok@b.com', password: 'pw' } },
+                { fields: { email: 'fail@b.com', password: 'pw' } },
+            ],
+            maxRetries: 0,
+        }));
+        expect(result.success).toBe(false);
+        expect(result.summary.succeeded).toBe(1);
+        expect(result.summary.failed).toBe(1);
+    });
+    it('sorts results by index for stable output', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [
+                { fields: { email: 'a@b.com', password: 'pw' } },
+                { fields: { email: 'c@d.com', password: 'pw' } },
+                { fields: { email: 'e@f.com', password: 'pw' } },
+            ],
+        }));
+        const indices = result.results.map((r) => r.index);
+        expect(indices).toEqual([0, 1, 2]);
+    });
+    it('uses account-N fallback when no fields', async () => {
+        const result = parseJson(await handler.handleBatchRegister({
+            registerUrl: 'http://test.com/register',
+            accounts: [{}],
+        }));
+        expect(result.results[0].idempotentKey).toContain('***');
+    });
+});

package/dist/tests/server/domains/workflow/handlers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/domains/workflow/handlers.test.js

@@ -0,0 +1,258 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const { mockIsSsrfTarget, mockIsPrivateHost, mockIsLoopbackHost, mockLookup, } = vi.hoisted(() => ({
+    mockIsSsrfTarget: vi.fn(async () => false),
+    mockIsPrivateHost: vi.fn(() => false),
+    mockIsLoopbackHost: vi.fn(() => false),
+    mockLookup: vi.fn(),
+}));
+vi.mock('@src/server/domains/network/replay', () => ({
+    isSsrfTarget: mockIsSsrfTarget,
+    isPrivateHost: mockIsPrivateHost,
+    isLoopbackHost: mockIsLoopbackHost,
+}));
+vi.mock('node:dns/promises', () => ({
+    lookup: mockLookup,
+}));
+import { WorkflowHandlers } from '../../../../src/server/domains/workflow/handlers.js';
+import { createWorkflow, ToolNodeBuilder } from '../../../../src/server/workflows/WorkflowContract.js';
+function parseJson(response) {
+    return JSON.parse(response.content[0].text);
+}
+function buildReservedDocIpv4() {
+    return [203, 0, 113, 10].map(String).join('.');
+}
+describe('WorkflowHandlers', () => {
+    const fetchMock = vi.fn();
+    const deps = {
+        browserHandlers: {
+            handlePageEvaluate: vi.fn(),
+            handlePageNavigate: vi.fn(),
+            handlePageClick: vi.fn(),
+            handlePageType: vi.fn(),
+            handleNetworkGetRequests: vi.fn(),
+        },
+        advancedHandlers: {
+            handleNetworkEnable: vi.fn(),
+            handleConsoleInjectFetchInterceptor: vi.fn(),
+            handleConsoleInjectXhrInterceptor: vi.fn(),
+            handleNetworkGetStats: vi.fn(),
+            handleNetworkGetRequests: vi.fn(),
+            handleNetworkExtractAuth: vi.fn(),
+            handleNetworkExportHar: vi.fn(),
+        },
+        serverContext: {
+            extensionWorkflowsById: new Map(),
+            extensionWorkflowRuntimeById: new Map(),
+            executeToolWithTracking: vi.fn(),
+            currentTier: 'workflow',
+            config: {},
+        },
+    };
+    let handlers;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.stubGlobal('fetch', fetchMock);
+        mockIsSsrfTarget.mockResolvedValue(false);
+        mockIsPrivateHost.mockReturnValue(false);
+        deps.advancedHandlers.handleNetworkGetStats.mockResolvedValue({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, stats: { totalRequests: 3 } }) }],
+        });
+        deps.advancedHandlers.handleNetworkGetRequests.mockResolvedValue({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, requests: [{ url: 'https://vmoranv.github.io/jshookmcp/api' }] }) }],
+        });
+        deps.advancedHandlers.handleNetworkExtractAuth.mockResolvedValue({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, findings: [] }) }],
+        });
+        handlers = new WorkflowHandlers(deps);
+    });
+    it('validates page_script_register required fields', async () => {
+        const body = parseJson(await handlers.handlePageScriptRegister({ name: '', code: '' }));
+        expect(body.success).toBe(false);
+        expect(body.error).toContain('name and code are required');
+    });
+    it('registers a custom page script', async () => {
+        const body = parseJson(await handlers.handlePageScriptRegister({
+            name: 'my_script',
+            code: '(() => 123)()',
+            description: 'demo',
+        }));
+        expect(body.success).toBe(true);
+        expect(body.name).toBe('my_script');
+        expect(body.action).toBe('registered');
+    });
+    it('returns available scripts when script is missing', async () => {
+        const body = parseJson(await handlers.handlePageScriptRun({ name: 'nope' }));
+        expect(body.success).toBe(false);
+        expect(body.error).toContain('not found');
+        expect(Array.isArray(body.available)).toBe(true);
+    });
+    it('runs registered script through browser handlePageEvaluate', async () => {
+        deps.browserHandlers.handlePageEvaluate.mockResolvedValue({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, value: 123 }) }],
+        });
+        await handlers.handlePageScriptRegister({
+            name: 'script_ok',
+            code: '(function(){ return { ok: true }; })()',
+        });
+        const response = await handlers.handlePageScriptRun({
+            name: 'script_ok',
+            params: { a: 1 },
+        });
+        expect(deps.browserHandlers.handlePageEvaluate).toHaveBeenCalledOnce();
+        const payload = deps.browserHandlers.handlePageEvaluate.mock.calls[0][0];
+        expect(payload.code).toContain('__params__');
+        expect(response.content[0].type).toBe('text');
+    });
+    it('returns execution error when page script run throws', async () => {
+        deps.browserHandlers.handlePageEvaluate.mockRejectedValue(new Error('eval failed'));
+        await handlers.handlePageScriptRegister({
+            name: 'script_fail',
+            code: '(() => 1)()',
+        });
+        const body = parseJson(await handlers.handlePageScriptRun({ name: 'script_fail' }));
+        expect(body.success).toBe(false);
+        expect(body.error).toContain('eval failed');
+        expect(body.script).toBe('script_fail');
+    });
+    it('validates api_probe_batch baseUrl', async () => {
+        const body = parseJson(await handlers.handleApiProbeBatch({}));
+        expect(body.success).toBe(false);
+        expect(body.error).toContain('baseUrl is required');
+    });
+    it('builds api_probe_batch page code with concurrent probing', async () => {
+        deps.browserHandlers.handlePageEvaluate.mockResolvedValue({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, probed: 2, results: {} }) }],
+        });
+        await handlers.handleApiProbeBatch({
+            baseUrl: 'https://vmoranv.github.io/jshookmcp',
+            paths: ['/a', '/b'],
+            method: 'GET',
+        });
+        expect(deps.browserHandlers.handlePageEvaluate).toHaveBeenCalledOnce();
+        const payload = deps.browserHandlers.handlePageEvaluate.mock.calls[0]?.[0];
+        expect(payload.code).toContain('Promise.all');
+        expect(payload.code).toContain('maxConcurrency');
+    });
+    it('executes web_api_capture_session without exporting files', async () => {
+        const body = parseJson(await handlers.handleWebApiCaptureSession({
+            url: 'https://vmoranv.github.io/jshookmcp',
+            waitUntil: 'domcontentloaded',
+            actions: [{ type: 'click', selector: 'button.capture' }],
+            exportHar: false,
+            exportReport: false,
+            waitAfterActionsMs: 0,
+        }));
+        expect(body.success).toBe(true);
+        expect(deps.advancedHandlers.handleNetworkEnable).toHaveBeenCalledOnce();
+        expect(deps.browserHandlers.handlePageNavigate).toHaveBeenCalledWith({
+            url: 'https://vmoranv.github.io/jshookmcp',
+            waitUntil: 'domcontentloaded',
+            enableNetworkMonitoring: true,
+        });
+        expect(deps.browserHandlers.handlePageClick).toHaveBeenCalledWith({ selector: 'button.capture' });
+    });
+    it('retries batch_register accounts and summarizes success', async () => {
+        const successResult = {
+            content: [{ type: 'text', text: JSON.stringify({ success: true, verified: true }) }],
+        };
+        const failureResult = {
+            content: [{ type: 'text', text: JSON.stringify({ success: false, error: 'temporary' }) }],
+        };
+        const flowSpy = vi.spyOn(handlers, 'handleRegisterAccountFlow')
+            .mockResolvedValueOnce(failureResult)
+            .mockResolvedValueOnce(successResult);
+        const body = parseJson(await handlers.handleBatchRegister({
+            registerUrl: 'https://vmoranv.github.io/jshookmcp/register',
+            accounts: [
+                { fields: { email: 'alice@example.com', password: 'secret' } },
+            ],
+            maxRetries: 1,
+            retryBackoffMs: 0,
+            timeoutPerAccountMs: 5000,
+        }));
+        expect(flowSpy).toHaveBeenCalledTimes(2);
+        expect(body.success).toBe(true);
+        expect(body.summary.succeeded).toBe(1);
+        expect(body.summary.failed).toBe(0);
+    });
+    it('lists loaded extension workflows', async () => {
+        deps.serverContext.extensionWorkflowsById.set('workflow.demo.v1', {
+            id: 'workflow.demo.v1',
+            displayName: 'Demo Workflow',
+            source: 'fixtures/demo.workflow.ts',
+            description: 'demo description',
+            tags: ['demo'],
+            timeoutMs: 5000,
+            defaultMaxConcurrency: 2,
+        });
+        const body = parseJson(await handlers.handleListExtensionWorkflows());
+        expect(body.success).toBe(true);
+        expect(body.count).toBe(1);
+        expect(body.workflows[0].id).toBe('workflow.demo.v1');
+    });
+    it('executes a loaded extension workflow with node input overrides', async () => {
+        const workflow = createWorkflow('workflow.demo.v1', 'Demo Workflow')
+            .buildGraph(() => new ToolNodeBuilder('demo-node', 'demo_tool').input({ value: 'base' }))
+            .build();
+        deps.serverContext.extensionWorkflowsById.set('workflow.demo.v1', {
+            id: 'workflow.demo.v1',
+            displayName: 'Demo Workflow',
+            source: 'fixtures/demo.workflow.ts',
+        });
+        deps.serverContext.extensionWorkflowRuntimeById.set('workflow.demo.v1', {
+            workflow,
+            source: 'fixtures/demo.workflow.ts',
+        });
+        deps.serverContext.executeToolWithTracking.mockResolvedValue({
+            content: [{ type: 'text', text: JSON.stringify({ success: true, echoed: true }) }],
+        });
+        const body = parseJson(await handlers.handleRunExtensionWorkflow({
+            workflowId: 'workflow.demo.v1',
+            nodeInputOverrides: {
+                'demo-node': { value: 'override' },
+            },
+        }));
+        expect(body.success).toBe(true);
+        expect(body.workflowId).toBe('workflow.demo.v1');
+        expect(deps.serverContext.executeToolWithTracking).toHaveBeenCalledWith('demo_tool', { value: 'override' });
+        expect(body.stepResults['demo-node']).toBeDefined();
+    });
+    it('keeps https bundle fetches on hostname to preserve TLS validation', async () => {
+        mockLookup.mockResolvedValue({ address: buildReservedDocIpv4(), family: 4 });
+        fetchMock.mockResolvedValue({
+            ok: true,
+            status: 200,
+            statusText: 'OK',
+            headers: { get: vi.fn(() => null) },
+            text: vi.fn(async () => 'const token = "abc";'),
+        });
+        const body = parseJson(await handlers.handleJsBundleSearch({
+            url: 'https://vmoranv.github.io/jshookmcp/assets/main.js',
+            patterns: [{ name: 'auth', regex: 'token' }],
+        }));
+        expect(body.success).toBe(true);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock).toHaveBeenCalledWith('https://vmoranv.github.io/jshookmcp/assets/main.js', expect.objectContaining({
+            redirect: 'manual',
+            headers: {},
+        }));
+    });
+    it('blocks remote http bundle fetches unless they are loopback', async () => {
+        const resolvedAddress = buildReservedDocIpv4();
+        mockLookup.mockResolvedValue({ address: resolvedAddress, family: 4 });
+        fetchMock.mockResolvedValue({
+            ok: true,
+            status: 200,
+            statusText: 'OK',
+            headers: { get: vi.fn(() => null) },
+            text: vi.fn(async () => 'const token = "abc";'),
+        });
+        const body = parseJson(await handlers.handleJsBundleSearch({
+            url: 'http://vmoranv.github.io/jshookmcp/assets/main.js',
+            patterns: [{ name: 'auth', regex: 'token' }],
+        }));
+        expect(body.success).toBe(false);
+        expect(body.error).toContain('insecure HTTP is only allowed for loopback targets');
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+});

package/dist/tests/server/http/HttpMiddleware.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/http/HttpMiddleware.test.js

@@ -0,0 +1,152 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { checkOrigin, checkAuth, checkRateLimit, readBodyWithLimit } from '../../../src/server/http/HttpMiddleware.js';
+function mockReq(overrides = {}) {
+    return {
+        headers: {},
+        socket: { remoteAddress: '127.0.0.1' },
+        ...overrides,
+    };
+}
+function mockRes() {
+    const res = {
+        _status: undefined,
+        _body: undefined,
+        writeHead(status) {
+            res._status = status;
+            return res;
+        },
+        end(body, cb) {
+            res._body = body;
+            if (typeof cb === 'function')
+                cb();
+            return res;
+        },
+    };
+    return res;
+}
+describe('HttpMiddleware', () => {
+    const originalEnv = { ...process.env };
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        delete process.env.MCP_AUTH_TOKEN;
+        delete process.env.MCP_HOST;
+        delete process.env.MCP_ALLOW_INSECURE;
+        delete process.env.MCP_RATE_LIMIT_ENABLED;
+        delete process.env.MCP_RATE_LIMIT_MAX;
+        delete process.env.MCP_RATE_LIMIT_WINDOW_MS;
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+    });
+    describe('checkOrigin', () => {
+        it('allows requests without Origin header (non-browser)', () => {
+            const req = mockReq({ headers: {} });
+            const res = mockRes();
+            expect(checkOrigin(req, res)).toBe(true);
+        });
+        it('allows localhost origins', () => {
+            for (const origin of ['http://127.0.0.1:3000', 'http://localhost:8080', 'http://[::1]:9090']) {
+                const req = mockReq({ headers: { origin } });
+                const res = mockRes();
+                expect(checkOrigin(req, res)).toBe(true);
+            }
+        });
+        it('rejects non-localhost origin when no auth token', () => {
+            const req = mockReq({ headers: { origin: 'http://evil.com' } });
+            const res = mockRes();
+            expect(checkOrigin(req, res)).toBe(false);
+            expect(res._status).toBe(403);
+        });
+        it('allows non-localhost origin when auth token is set', () => {
+            process.env.MCP_AUTH_TOKEN = 'secret';
+            const req = mockReq({ headers: { origin: 'http://remote.com' } });
+            const res = mockRes();
+            expect(checkOrigin(req, res)).toBe(true);
+        });
+        it('rejects malformed Origin header', () => {
+            const req = mockReq({ headers: { origin: 'not-a-url' } });
+            const res = mockRes();
+            expect(checkOrigin(req, res)).toBe(false);
+            expect(res._status).toBe(403);
+        });
+    });
+    describe('checkAuth', () => {
+        it('allows requests when no auth token configured (localhost)', () => {
+            process.env.MCP_HOST = '127.0.0.1';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('rejects non-local binding without token or insecure flag', () => {
+            process.env.MCP_HOST = '0.0.0.0';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(false);
+            expect(res._status).toBe(403);
+        });
+        it('allows non-local binding with MCP_ALLOW_INSECURE=1', () => {
+            process.env.MCP_HOST = '0.0.0.0';
+            process.env.MCP_ALLOW_INSECURE = '1';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('validates correct bearer token', () => {
+            process.env.MCP_AUTH_TOKEN = 'mysecret';
+            const req = mockReq({
+                headers: { authorization: 'Bearer mysecret' },
+            });
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(true);
+        });
+        it('rejects wrong bearer token', () => {
+            process.env.MCP_AUTH_TOKEN = 'mysecret';
+            const req = mockReq({
+                headers: { authorization: 'Bearer wrongtoken' },
+            });
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(false);
+            expect(res._status).toBe(403);
+        });
+        it('rejects missing authorization header', () => {
+            process.env.MCP_AUTH_TOKEN = 'mysecret';
+            const req = mockReq({ headers: {} });
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(false);
+            expect(res._status).toBe(401);
+        });
+        it('rejects non-Bearer authorization scheme', () => {
+            process.env.MCP_AUTH_TOKEN = 'mysecret';
+            const req = mockReq({
+                headers: { authorization: 'Basic dXNlcjpwYXNz' },
+            });
+            const res = mockRes();
+            expect(checkAuth(req, res)).toBe(false);
+            expect(res._status).toBe(401);
+        });
+    });
+    describe('checkRateLimit', () => {
+        it('allows requests when rate limiting is disabled', () => {
+            process.env.MCP_RATE_LIMIT_ENABLED = '0';
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkRateLimit(req, res)).toBe(true);
+        });
+        it('allows requests within limit', () => {
+            const req = mockReq();
+            const res = mockRes();
+            expect(checkRateLimit(req, res)).toBe(true);
+        });
+    });
+    describe('readBodyWithLimit', () => {
+        it('rejects oversized Content-Length upfront', async () => {
+            const req = mockReq({
+                headers: { 'content-length': '999999999' },
+            });
+            req.on = vi.fn();
+            const res = mockRes();
+            await expect(readBodyWithLimit(req, res, 1024)).rejects.toThrow('body_too_large');
+            expect(res._status).toBe(413);
+        });
+    });
+});

package/dist/tests/services/LLMService.test.d.ts

@@ -0,0 +1 @@
+export {};