@pipeworx/mcp-edge-case-museum 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mojibake Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,340 @@
-# Temporary Holding Version
+# edge-case-museum
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Your code works. Except for these wonderfully terrible inputs.**
+
+Part of [Pipeworx](https://pipeworx.io) — an MCP gateway connecting AI agents to 1796+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.
+
+By [Mojibake](https://pipeworx.io), creators of Pipeworx.
+
+Tell it what you are building ("username uniqueness", "parse a CSV upload",
+"store and add up money amounts", "schedule a reminder in the user's
+timezone") and it hands back the inputs that quietly break that kind of code:
+the assumption each one breaks, the exact bytes, what goes wrong, why, the
+safer pattern, and a repro in Python and JavaScript whose output came from
+actually running it. Then it writes you a test file of those inputs, pointed
+at your own function.
+
+## Three exhibits
+
+Every output below was printed by running the code, by the same harness that
+checks the whole collection (Python 3.14.2, Node.js v22.22.2).
+
+### 1. One NaN can leave the rest of your list unsorted
+
+`edge_case_get({ id: "nan-in-sort" })`
+
+```python
+nan = float("nan")
+print(sorted([3, nan, 1]))
+```
+
+```
+[3, nan, 1]
+```
+
+```js
+console.log([3, NaN, 1].sort((a, b) => a - b));
+```
+
+```
+[ 3, NaN, 1 ]
+```
+
+Not "NaN ends up somewhere odd". The 3 and the 1 are left out of order. Every
+comparison with NaN is false, so the sort sees NaN as equal to everything.
+That breaks transitivity (3 "equals" NaN, NaN "equals" 1, so 3 "equals" 1),
+and the algorithm concludes the list is already sorted. Python promises
+nothing for inconsistent comparisons. ECMAScript makes the order
+implementation-defined.
+
+### 2. "01/01/68" is 2068 in Python and 1968 in Node.js
+
+`edge_case_get({ id: "two-digit-year-century-pivot-mismatch" })`
+
+```python
+for s in ("01/01/49", "01/01/50", "01/01/68", "01/01/69"):
+    print(s, "->", datetime.strptime(s, "%m/%d/%y").year)
+```
+
+```
+01/01/49 -> 2049
+01/01/50 -> 2050
+01/01/68 -> 2068
+01/01/69 -> 1969
+```
+
+```js
+for (const s of ['01/01/49', '01/01/50', '01/01/68', '01/01/69'])
+  console.log(s, '->', new Date(s).getFullYear());
+```
+
+```
+01/01/49 -> 2049
+01/01/50 -> 1950
+01/01/68 -> 1968
+01/01/69 -> 1969
+```
+
+Python follows the POSIX pivot at 69. V8 pivots at 50. The two agree on every
+two-digit year except 50 through 68, where they are a century apart. Test a
+handful of dates and you will probably never hit one.
+
+### 3. `Intl` says the Iraqi dinar has no decimals. ISO 4217 says it has three.
+
+`edge_cases_find({ context: "store and add up money amounts", language: "javascript" })`
+
+```js
+for (const c of ["USD", "JPY", "BHD", "KWD", "CLF", "IQD", "HUF"]) {
+  const digits = new Intl.NumberFormat("en-US", { style: "currency", currency: c })
+    .resolvedOptions().maximumFractionDigits;
+  console.log(c, digits);
+}
+```
+
+```
+USD 2
+JPY 0
+BHD 3
+KWD 3
+CLF 4
+IQD 0
+HUF 0
+```
+
+The first lesson is that `amount * 100` is wrong for JPY (a 100x overcharge)
+and for BHD (a 10x undercharge). The second is quieter: the obvious fix,
+asking `Intl` how many decimals a currency has, returns CLDR display data, not
+ISO 4217. IQD is 3 in ISO 4217 and HUF is 2, and `Intl` reports 0 for both.
+Store the exponent your payment processor uses. Don't derive it from a
+formatter.
+
+### And then it writes the test
+
+`edge_cases_test_file({ context: "parse a CSV upload", language: "python" })`
+returns a pytest file of eight cases from seven CSV exhibits. Pointed at the
+parser most of us write first, `list(csv.reader(io.StringIO(text)))`:
+
+```
+PASSED test_edge_case[csv-formula-injection-excel]
+PASSED test_edge_case[csv-crlf-trailing-blank-line0]
+PASSED test_edge_case[csv-crlf-trailing-blank-line1]
+PASSED test_edge_case[csv-quoted-field-with-newline]
+PASSED test_edge_case[csv-doubled-quote-escaping]
+PASSED test_edge_case[csv-quoted-field-with-comma]
+FAILED test_edge_case[csv-utf8-bom-first-header]
+FAILED test_edge_case[csv-semicolon-delimited-european-excel]
+2 failed, 6 passed
+```
+
+Two real bugs: the first header comes back as `"name"` from a file saved
+as Excel's "CSV UTF-8", and a semicolon-delimited export from a decimal-comma
+locale parses as one column. Each failure names the exhibit that explains it.
+
+## What is in it
+
+122 exhibits, every one with at least one repro that was executed:
+
+| Category | Exhibits | For example |
+|---|---|---|
+| Unicode | 15 | NFC vs NFD usernames, Turkish dotted I, ß case folding, Cyrillic homoglyphs, zero-width characters, Zalgo text |
+| Dates and time | 18 | DST gaps and overlaps, Nepal's +05:45, Samoa's missing day, leap seconds, 2038, ISO week years |
+| Floating point and money | 17 | `round(2.675, 2)`, `(1.005).toFixed(2)`, banker's rounding, currency minor units, -0 balances |
+| Sorting and comparison | 14 | collation vs code points, Swedish å after z, `[10, 9, 1].sort()`, boolean comparators |
+| Filenames and paths | 15 | `CON.txt`, trailing dots, `os.path.join` with an absolute part, NTFS streams, 255-byte names |
+| Parsing | 15 | CSV quoting and BOMs, JSON duplicate keys and 64-bit ids, WHATWG backslashes, valid emails rejected |
+| Integers | 14 | `MAX_SAFE_INTEGER + 1 === MAX_SAFE_INTEGER + 2`, `parseInt(null, 36)`, `-7 % 2` |
+| Names and addresses | 14 | particles in surnames, mononyms, `"Null"` as a surname, ZIP codes with leading zeros |
+
+## Tools
+
+- `edge_cases_find({ context, language?, limit? })` — what you are
+  implementing, in plain words, to the exhibits that matter for it. Each comes
+  with the repro for your language and a `refine_tags` list to narrow down.
+- `edge_case_get({ id })` — one exhibit in full: every repro with its captured
+  output and runtime version, the why, the fix, related exhibits, sources.
+- `edge_cases_browse({ category?, tag? })` — the collection by category
+  (`unicode`, `datetime`, `float-money`, `sorting`, `filenames`, `parsing`,
+  `integers`, `names-addresses`) or by tag (`username`, `csv`, `money`,
+  `timezone`, ...).
+- `edge_cases_test_file({ context, language })` — one runnable pytest or
+  `node:test` file bundling the relevant inputs as cases. It runs as generated
+  against a stub; replace the stub (marked TODO) with your function and the
+  failures tell you which exhibit to read.
+
+## Install
+
+### Remote (no setup)
+
+```json
+{
+  "mcpServers": {
+    "edge-case-museum": {
+      "url": "https://gateway.pipeworx.io/edge-case-museum/mcp"
+    }
+  }
+}
+```
+
+This endpoint also carries the shared Pipeworx tools (`ask_pipeworx`,
+`discover_tools`, and friends).
+
+### Local
+
+```json
+{
+  "mcpServers": {
+    "edge-case-museum": {
+      "command": "npx",
+      "args": ["-y", "@pipeworx/mcp-edge-case-museum"]
+    }
+  }
+}
+```
+
+The whole collection ships inside the package. No network calls, no account.
+
+## Auth
+
+Keyless.
+
+## Why trust it
+
+- **No output is typed from memory.** Every Python and JavaScript repro is
+  executed by a committed harness, and its `expected_output` is what the run
+  printed. `verified_with` names the runtime (for example `Python 3.14.2`,
+  `Node.js v22.22.2`), because some of these behaviours change between
+  versions and you should know which one we saw.
+- **The harness can fail, and has.** Change one character of an expected
+  output and the run goes red with the diff. A repro whose code or output was
+  edited without re-running it cannot be baked into the pack at all: the bake
+  checks a hash the harness recorded.
+- **Stacks we did not run are labelled.** Postgres, Windows and macOS filesystem behaviour
+  appear as `documented`, with the source that says so, never as verified.
+- **Every exhibit cites its spec or docs.** Unicode annexes, RFC sections, the
+  ECMAScript spec, IEEE 754 references, ISO 4217, IANA tz, the language docs.
+  Written in our own words.
+
+## Data sources
+
+- Exhibits written for this collection by Mojibake, each citing the standard
+  or documentation it rests on.
+- Some inputs come from the [Big List of Naughty Strings](https://github.com/minimaxir/big-list-of-naughty-strings)
+  by Max Woolf (MIT licence); exhibits that use one say so in their sources.
+- No real person's name, address or contact detail appears anywhere. The
+  names-and-addresses exhibits use invented examples and state facts about
+  naming and addressing systems.
+
+## Contribute an exhibit
+
+Add one file, `src/exhibits/CATEGORY/ID.json` (copy any existing exhibit
+for the shape), with your repros' `code` but no `expected_output`. Run
+`node src/harness.mjs --only ID --capture`: it executes
+each repro, writes the real output into your file, and records it. Read what
+it captured; if the output does not say what your explanation says, the
+explanation is wrong. Then `node src/bake.mjs` and open a pull
+request. An exhibit whose repro has not been run by the harness
+will not bake.
+
+## Quick Start
+
+Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
+
+```json
+{
+  "mcpServers": {
+    "edge-case-museum": {
+      "url": "https://gateway.pipeworx.io/edge-case-museum/mcp"
+    }
+  }
+}
+```
+
+### What this endpoint actually serves
+
+`tools/list` at `https://gateway.pipeworx.io/edge-case-museum/mcp` returns the tools in the table
+above **plus the shared Pipeworx meta-tools** — `ask_pipeworx`,
+`discover_tools`, `search_within`, `remember`/`recall` and the rest of the
+gateway-wide set. So the tool count you see is larger than this table: a
+single-pack endpoint currently lists roughly 30 shared tools alongside the
+pack's own. The connection's `initialize` response states its exact scope, and
+is the authoritative answer for a given day.
+
+This is deliberate, not multiplexing by accident. The meta-tools are what let a
+scoped connection answer a question this pack does not cover — via
+`ask_pipeworx`, which routes across the whole catalog — without you adding a
+second MCP server. There is currently no way to mount a pack endpoint without
+them; if the extra schemas cost you more context than the routing is worth,
+connect to the full gateway once rather than to several pack endpoints.
+
+Or connect to the full Pipeworx gateway to get every pack's tools listed
+directly, instead of just this one's:
+
+```json
+{
+  "mcpServers": {
+    "pipeworx": {
+      "url": "https://gateway.pipeworx.io/mcp"
+    }
+  }
+}
+```
+
+Both URLs reach the same gateway and the same 1796+ data sources. The
+only difference is which pack's tools are listed **directly**; `ask_pipeworx`
+reaches all of them from either one.
+
+## No MCP client? Call it over HTTP
+
+```bash
+curl -X POST https://gateway.pipeworx.io/v1/tools/edge_cases_find \
+  -H 'Content-Type: application/json' \
+  -d '{"context":"username uniqueness","language":"python"}'
+```
+
+No account needed for the first calls. Inspect any tool: `GET https://gateway.pipeworx.io/v1/tools/edge_cases_find`. Find one: `POST https://gateway.pipeworx.io/v1/tools/search_packs` with `{"query":"..."}`.
+
+## Standalone (no gateway account)
+
+This package also runs as a local stdio MCP server — no Pipeworx account, no
+gateway round-trip:
+
+```json
+{
+  "mcpServers": {
+    "edge-case-museum": {
+      "command": "npx",
+      "args": ["-y", "@pipeworx/mcp-edge-case-museum"]
+    }
+  }
+}
+```
+
+Or run it directly to confirm it starts:
+
+```bash
+npx -y @pipeworx/mcp-edge-case-museum
+```
+
+It speaks MCP over stdin/stdout and answers `initialize`/`tools/list`/`tools/call`
+for **only** this pack's tools — none of the shared meta-tools the gateway
+connection above adds. Same source, same tools, no ask_pipeworx routing.
+
+## Using with ask_pipeworx
+
+Instead of calling tools directly, you can ask questions in plain English —
+this works on the pack endpoint above as well as on the full gateway:
+
+```
+ask_pipeworx({ question: "your question about Edge Case Museum data" })
+```
+
+The gateway picks the right tool and fills the arguments automatically.
+
+## More
+
+- [Docs and guides](https://pipeworx.io/docs)
+- [pipeworx.io](https://pipeworx.io)
+
+## License
+
+MIT

package/bin/cli.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+//
+// Entry point for `npx @pipeworx/mcp-<slug>`.
+//
+// Packs ship as raw TypeScript (no build step — see publish-pack.sh for why:
+// tsx sidesteps every extensionless-import / bare-JSON-import edge case a
+// per-pack tsc build would have to solve one pack at a time). This file
+// registers tsx's ESM loader programmatically, then hands off to src/server.ts,
+// which wraps the pack's {tools, callTool} export in a stdio MCP server.
+//
+// Copied verbatim into every published pack repo by scripts/publish-pack.sh —
+// edit this file, not a per-pack copy.
+import { register } from 'tsx/esm/api';
+
+register();
+
+await import('../src/server.ts');

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@pipeworx/mcp-edge-case-museum",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Edge Case Museum MCP — 'Your code works. Except for these wonderfully terrible inputs.'",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "bin": {
+    "mcp-edge-case-museum": "bin/cli.js"
+  },
+  "keywords": ["mcp", "mcp-server", "model-context-protocol", "pipeworx", "edge-case-museum"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pipeworx-io/mcp-edge-case-museum.git"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "tsx": "^4.19.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "@cloudflare/workers-types": "^4.20260405.1"
+  },
+  "pipeworx": {
+    "sourceHash": "v1-3081b54dc5f3854258063da594df22057720b4c6b7031476727e233a9e85981d",
+    "sourceCommit": "1095bbbaeb7ef746539b45866b28b1fd6b1f8549"
+  }
+}

package/server.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.pipeworx-io/edge-case-museum",
+  "title": "Edge Case Museum",
+  "description": "Edge Case Museum MCP — 'Your code works. Except for these wonderfully terrible inputs.'",
+  "version": "0.1.0",
+  "websiteUrl": "https://pipeworx.io/packs/edge-case-museum",
+  "repository": {
+    "url": "https://github.com/pipeworx-io/mcp-edge-case-museum",
+    "source": "github"
+  },
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://gateway.pipeworx.io/edge-case-museum/mcp"
+    }
+  ]
+}

package/src/bake.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+/**
+ * Bake the Edge Case Museum index (fleet #3034).
+ *
+ * Reads every exhibit in src/exhibits/<category>/<id>.json
+ * and writes src/ecm-index-data.ts, which is registered in
+ * workers/gateway/src/pack-baked-indexes.json: it ships to KV and the gateway
+ * injects it as args._bakedIndex, so the pack never value-imports it.
+ *
+ * The bake is the second half of the "no unexecuted claim" rule. The harness
+ * (src/harness.mjs) runs every python / javascript repro
+ * and records sha256(code, expected_output) in src/verified.json. This script
+ * REFUSES to write the module if any executable repro is missing from that file
+ * or its hash differs, i.e. if anyone edited a repro or its output without
+ * re-running it. Documented (non-executed) repros are shipped labelled as such.
+ *
+ * Usage:  node src/bake.mjs [--check]
+ *         --check  validate and compare with the committed module; exit 1 if stale.
+ */
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadExhibits, validateExhibit, reproHash, normalizeOutput, RUNNABLE } from './harness.mjs';
+
+const PACK = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ROOT = PACK;
+const DIR = path.join(PACK, 'src/exhibits');
+const OUT = path.join(PACK, 'src/ecm-index-data.ts');
+const CHECK = process.argv.includes('--check');
+
+const loaded = loadExhibits(DIR);
+const errors = [];
+for (const e of loaded) errors.push(...validateExhibit(e));
+const verified = existsSync(path.join(PACK, 'src/verified.json')) ? JSON.parse(readFileSync(path.join(PACK, 'src/verified.json'), 'utf8')).repros ?? {} : {};
+const exhibits = [];
+const ids = new Set();
+for (const { ex, file } of loaded) {
+  if (!ex) continue;
+  if (ids.has(ex.id)) errors.push(`duplicate id ${ex.id}`);
+  ids.add(ex.id);
+  for (const r of ex.repros ?? []) {
+    if (r.status === 'documented' || !RUNNABLE[r.language]) continue;
+    const key = `${ex.id}:${r.language}`;
+    const row = verified[key];
+    if (typeof r.expected_output !== 'string') errors.push(`${path.relative(ROOT, file)}: ${r.language} repro has no expected_output; run the harness with --capture`);
+    else if (!row) errors.push(`${key}: not in src/verified.json; run node src/harness.mjs`);
+    else if (row.sha256 !== reproHash(r.code, normalizeOutput(r.expected_output))) errors.push(`${key}: code or expected_output changed since the harness last ran it; re-run the harness`);
+  }
+  exhibits.push(ex);
+}
+for (const ex of exhibits) for (const rel of ex.related ?? []) if (!ids.has(rel)) errors.push(`${ex.id}: related id "${rel}" does not exist`);
+if (exhibits.length < 1) errors.push('no exhibits found');
+if (errors.length) {
+  console.error(`edge-case-museum bake REFUSED (${errors.length} problem(s)):\n  ${errors.slice(0, 60).join('\n  ')}`);
+  process.exit(1);
+}
+
+exhibits.sort((a, b) => a.category.localeCompare(b.category) || a.id.localeCompare(b.id));
+const shipped = exhibits.map((ex) => ({
+  id: ex.id,
+  title: ex.title,
+  category: ex.category,
+  assumption: ex.assumption,
+  input: { display: ex.input.display, description: ex.input.description ?? '' },
+  what_goes_wrong: ex.what_goes_wrong,
+  why: ex.why,
+  affects: ex.affects,
+  repros: ex.repros.map((r) =>
+    r.status === 'documented'
+      ? { language: r.language, status: 'documented', note: r.note, source: r.source }
+      : { language: r.language, status: 'verified', code: r.code, expected_output: normalizeOutput(r.expected_output), verified_with: verified[`${ex.id}:${r.language}`].verified_with },
+  ),
+  fix: ex.fix,
+  related: ex.related ?? [],
+  sources: ex.sources,
+  tags: ex.tags,
+  test_cases: ex.test_cases ?? [],
+}));
+const byCat = {};
+for (const ex of shipped) byCat[ex.category] = (byCat[ex.category] ?? 0) + 1;
+const runtimes = JSON.parse(readFileSync(path.join(PACK, 'src/verified.json'), 'utf8')).runtimes ?? {};
+// data_as_of is the content's date, not the bake's: the newest exhibit file's last commit would be ideal,
+// but a deterministic module matters more for --check, so it is passed in or taken from verified.json's runtimes stamp.
+const DATA_AS_OF = process.env.ECM_DATA_AS_OF ?? (existsSync(OUT) ? (readFileSync(OUT, 'utf8').match(/DATA_AS_OF = "([^"]+)"/)?.[1] ?? new Date().toISOString().slice(0, 10)) : new Date().toISOString().slice(0, 10));
+
+const body = `// GENERATED by src/bake.mjs from src/exhibits/ — do not hand-edit; re-run the script.
+// ${shipped.length} exhibits (${Object.entries(byCat).map(([k, v]) => `${k} ${v}`).join(', ')}) · repros verified with ${Object.values(runtimes).join(' and ')}
+// Registered in workers/gateway/src/pack-baked-indexes.json; the pack reads it as args._bakedIndex and never value-imports this module.
+
+export interface Repro { language: string; status: 'verified' | 'documented'; code?: string; expected_output?: string; verified_with?: string; note?: string; source?: string }
+export interface TestCase { inputs: unknown[]; relation: 'equal' | 'not_equal' | 'returns' | 'no_crash' | 'raises'; expected?: unknown; note?: string }
+export interface Exhibit {
+  id: string; title: string; category: string; assumption: string; input: { display: string; description: string };
+  what_goes_wrong: string; why: string; affects: string[]; repros: Repro[]; fix: string; related: string[];
+  sources: { title: string; url: string }[]; tags: string[]; test_cases: TestCase[];
+}
+
+export const DATA_AS_OF = ${JSON.stringify(DATA_AS_OF)};
+export const RUNTIMES: Record<string, string> = ${JSON.stringify(runtimes)};
+export const EXHIBITS: Exhibit[] = ${JSON.stringify(shipped)};
+`;
+if (CHECK) {
+  const cur = existsSync(OUT) ? readFileSync(OUT, 'utf8') : '';
+  if (cur !== body) {
+    console.error('edge-case-museum: src/ecm-index-data.ts is stale; run node src/bake.mjs');
+    process.exit(1);
+  }
+  console.log(`edge-case-museum index up to date: ${shipped.length} exhibits`);
+} else {
+  writeFileSync(OUT, body);
+  console.log(`wrote ${path.relative(ROOT, OUT)}: ${shipped.length} exhibits (${Object.entries(byCat).map(([k, v]) => `${k} ${v}`).join(', ')}), ${(body.length / 1024).toFixed(0)} KB`);
+}