@pixlcore/xycli 1.1.0 → 1.2.0

package/test/fixtures/mcp/localhost.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCn/21gfsFiPQey
+mlEIulaMgYhuiLe26g+ELntBw+7ZPENhKgdvqtLs+AVxwV0avxs6F+bx/kgrFktL
+vyF9o0PHj30NNf81pTulHju9H9HLFuY/XCiO6jnc3cagxeuwAzoAr/YpsrVHUhaU
+wPrNDmuwCu2kNMSFB3FuQrZCCOneqfOy5eCbGWwnSb/w4AJq+4p2J43KeXoJ0nvn
+60mfgBXSOpodXsIOTtDJbZiDpIMJlUOWTgW1rLFzTkI8CWHxY4+e9RMheTZISkDe
+nn0P+Ef3IDaLO8QxMbjmk4i2gnC0W8YVlzUM+WeDeJ7UD+VQoS2gD7mWTYD3UmD+
+wglTGKuRAgMBAAECggEACTWewLFyLHkoA4nOHhUI9ZQ27x2eOfAZgFIuqOudcQSK
+tQ2MHCUDLGu+8KjRpSELfw3HDUZhR8C7HqCQV3DXIF4kqXq8+NXhWoCOdHmwEzAN
+gzUBdtmEPoVchCfAGdqzbUziyQ+7kaNVtZCMBH22jY9WeQVOLfS7KnjhwOZNhnU3
+vpstAKtdnc4tbxqT+z1b2clqvhO2fIFVPi4gPFM9oTvjSVyq51qoQB7nvnarJJSd
+u7WFJXvvH9gY2yLdS1/efwxNG6mxkaNq6SbKKF9/WaqLNo4qctFAdGZ486LrSQZf
+FiPOC7MCi9+UViy04cFebdibgmi9eAMiiIEdvDvJGQKBgQDnz81WrV2w9v0KGIeu
+yByIoNv4apIM1fggM+0xu4oroD2Xakdh5VlGREJ7eHrPqQRTFtKH11LcYKqC7Zjs
+fxmeNwb6fLZADX1cxKPjaUJXj4lK3HZC5VUM0YxC+iHOAZhmuHR3RbYj5ur/kXSh
+6UoRRQvIllXWo2Icf5X9xhZGCwKBgQC5hwPChGPsUc4F/QRzturaXt88e50vViny
+Fqf8csujqk2isxg2NlbPcNlqeQ7jjW1iS3iUmVhpTThiri4cvTcLqG5xAQFLZ58a
++crcN3sBkNSpMYwYkxeU7MYYaLtZsDjv+kN1Xq2n7MdfSiIBPrTSx624QUSVUy7W
+1dg7DceiUwKBgQDZ5Y/rcMzHwnK6IbKwjTOdDi+Ww34DiMFSa90CyXkoZtheUq1E
+jRQso48mhmpSdlo1TBebTsB5nHfK2FHNw+8ttCXgIIgjj0qOf9xZsCCHM8nmz3Ju
+kSkwAmzorDxIa2F49NutHZ8HAlFU58INS7+umgtogj+voSZhCWDRCXj4XwKBgCOX
+uGvv9C+ZPho+AUWl2QaN3uv+lxhGwoNUP2QaLeE3Qe+txj5YTG09rChWEzoqnsqV
+ygtQI/sHuoKMAgK3dkEBTjbVx4bM2WRWecmnxyx0uae//q2UQpjql9KE/TRmr3Wy
+oJB62nv13AX29fEhM5Wggz5vHxY6wCitG++wZBVLAoGAWB2yh8ICGTfcgfVFxTNv
+fj54c/EnZXP6OxQ3Isz7tYy/aNDFubcQPhdjMS+bd5q0W7WMiP4NBv8+lkMh0sWx
+Yawi8CYIFTcV8fYmXV3ord2D+NbcVfobcf9UE2W7zbv15nZ1+LrICimIlcPfX83R
+7PlB6dvbKNLI//9+yXExN7w=
+-----END PRIVATE KEY-----

package/test/helpers/mcp.js

@@ -0,0 +1,78 @@
+// Small wire-level MCP clients keep the tests independent of another SDK dep.
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const readline = require('node:readline');
+const Path = require('node:path');
+
+async function decode(response) {
+	const body = await response.text();
+	if (response.headers.get('content-type')?.includes('text/event-stream')) {
+		const line = body.split('\n').find(line => line.startsWith('data: '));
+		return JSON.parse(line.slice(6));
+	}
+	return JSON.parse(body);
+}
+
+async function httpRPC(url, method, params = {}, options = {}) {
+	const modern = options.modern;
+	if (modern) params = { ...params, _meta: { 'io.modelcontextprotocol/protocolVersion': '2026-07-28', 'io.modelcontextprotocol/clientCapabilities': {} } };
+	const response = await fetch(url, {
+		method: 'POST', signal: AbortSignal.timeout(10000),
+		headers: {
+			'Content-Type': 'application/json', Accept: 'application/json, text/event-stream',
+			...(modern ? { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': method, ...(params.name ? { 'Mcp-Name': params.name } : {}) } : {}),
+			...options.headers
+		}, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params })
+	});
+	return decode(response);
+}
+
+function stdioClient(t, env = {}, args = ['mcp', 'stdio']) {
+	const child = spawn(process.execPath, [Path.resolve(__dirname, '../../index.js'), ...args], {
+		stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, ...env }
+	});
+	let stderr = '';
+	const lines = [];
+	const pending = new Map();
+	let id = 0;
+	child.stderr.on('data', data => { stderr += data; });
+	const exit = once(child, 'exit');
+	const reader = readline.createInterface({ input: child.stdout });
+	reader.on('line', line => {
+		lines.push(line);
+		let message;
+		try { message = JSON.parse(line); }
+		catch (err) {
+			for (const call of pending.values()) call.reject(new Error('Non-JSON stdout: ' + line));
+			return;
+		}
+		pending.get(message.id)?.resolve(message);
+	});
+	t.after(async () => {
+		if (child.exitCode === null && child.signalCode === null) child.kill('SIGTERM');
+		await exit;
+	});
+	
+	return {
+		child, lines, exit, stderr: () => stderr,
+		request(method, params = {}) {
+			const requestId = ++id;
+			return new Promise((resolve, reject) => {
+				const timer = setTimeout(() => { pending.delete(requestId); reject(new Error('MCP response timeout: ' + method + '; ' + stderr)); }, 10000);
+				pending.set(requestId, {
+					resolve(value) { clearTimeout(timer); pending.delete(requestId); resolve(value); },
+					reject(error) { clearTimeout(timer); pending.delete(requestId); reject(error); }
+				});
+				child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id: requestId, method, params }) + '\n');
+			});
+		},
+		async initialize() {
+			return this.request('initialize', { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'xycli-test', version: '1' } });
+		},
+		async call(name, args) {
+			return this.request('tools/call', { name, arguments: args });
+		}
+	};
+}
+
+module.exports = { decode, httpRPC, stdioClient };

package/test/mcp-http-unit.test.js

@@ -0,0 +1,188 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const https = require('node:https');
+const fs = require('node:fs');
+const Path = require('node:path');
+const { configuration } = require('../lib/mcp.js');
+const { createContext } = require('../lib/mcp/context.js');
+const factory = require('../lib/mcp/server.js');
+const start = require('../lib/mcp/transports/http.js');
+const tools = require('../lib/mcp/registry.js')();
+const { httpRPC } = require('./helpers/mcp.js');
+
+test('HTTP serves both protocol generations, validates calls and rejects unauthorized access', async t => {
+	let calls = 0;
+	const context = createContext({ get_event: async (params, options) => { calls++; assert.equal(options.headers['X-API-Key'], 'test-token'); return { data: { code: 0, event: { id: params.id, revision: 1 } } }; } }, { read_only: true, api_key: 'server-key-must-not-be-used' });
+	const options = { ...configuration({}, {}), port: 0, log() {} };
+	const service = await start(factory(tools, context), options);
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const headers = { Authorization: 'Bearer test-token' };
+	for (const authorization of ['', 'Basic abc', 'Bearer', 'Bearer ', 'Bearer key extra']) {
+		assert.equal((await fetch(url, { headers: { Authorization: authorization } })).status, 401);
+	}
+	assert.equal(calls, 0);
+	assert.equal((await fetch(url, { headers: { ...headers, Origin: 'https://evil.example' } })).status, 403);
+	assert.equal((await fetch(url + '/other', { headers })).status, 404);
+	
+	for (const modern of [false, true]) {
+		const listing = await httpRPC(url, 'tools/list', {}, { headers, modern });
+		assert.equal(listing.result.tools.length, 8);
+		assert.ok(listing.result.tools.every(tool => tool.annotations.readOnlyHint));
+		const response = await httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id: 'e1' } }, { headers, modern });
+		assert.equal(response.result.structuredContent.event.id, 'e1');
+	}
+	assert.equal(calls, 2);
+	const invalid = await httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id: 'bad/id' } }, { headers });
+	assert.ok(invalid.error || invalid.result.isError);
+	const forbidden = await httpRPC(url, 'tools/call', { name: 'delete_event', arguments: { id: 'e1' } }, { headers });
+	assert.ok(forbidden.error || forbidden.result.isError);
+	assert.equal(calls, 2);
+	const malformed = await fetch(url, { method: 'POST', headers: { ...headers, 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }, body: '{broken' });
+	assert.equal(malformed.status, 400);
+	// Send the declared size first: the adapter can reject it before reading a
+	// body, without racing a megabyte upload against the closed connection.
+	const oversizedStatus = await new Promise((resolve, reject) => {
+		const req = http.request(url, { method: 'POST', headers: { ...headers, 'Content-Length': options.max_request_bytes + 1 } }, response => {
+			response.resume();
+			response.on('end', () => { resolve(response.statusCode); req.destroy(); });
+		});
+		req.on('error', reject);
+		req.flushHeaders();
+	});
+	assert.equal(oversizedStatus, 413);
+	
+	// Exercise the real Host header instead of trusting URL-only validation.
+	const status = await new Promise((resolve, reject) => {
+		const req = http.get(url, { headers: { ...headers, Host: 'evil.example' } }, response => { response.resume(); resolve(response.statusCode); });
+		req.on('error', reject);
+	});
+	assert.equal(status, 403);
+	await service.close();
+});
+
+test('concurrent HTTP tools keep their keys across multiple API calls', async t => {
+	const calls = [];
+	const context = createContext({ get_event: async (params, options) => {
+		assert.equal(options.headers['X-API-Key'], params.id + '-key');
+		calls.push(options.headers['X-API-Key']);
+		await new Promise(resolve => setTimeout(resolve, params.id === 'slow' ? 25 : 1));
+		return { data: { code: 0, event: { id: params.id } } };
+	} }, { api_key: 'server-key-must-not-be-used' });
+	const custom = new Map(tools);
+	const original = tools.get('get_event');
+	custom.set('get_event', { ...original, async run(args, invocation) {
+		await original.run(args, invocation);
+		return original.run(args, invocation);
+	} });
+	const service = await start(factory(custom, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const replies = await Promise.all(['slow', 'fast'].map(id => httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id } }, { headers: { Authorization: 'Bearer ' + id + '-key' } })));
+	assert.deepEqual(replies.map(reply => reply.result.structuredContent.event.id), ['slow', 'fast']);
+	assert.deepEqual(calls.sort(), ['fast-key', 'fast-key', 'slow-key', 'slow-key']);
+});
+
+test('HTTP tool errors redact the requesting client key', async t => {
+	const context = createContext({ get_event: async (params, options) => ({
+		err: 'Rejected key: ' + options.headers['X-API-Key']
+	}) }, { api_key: 'server-default' });
+	const service = await start(factory(tools, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const response = await httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id: 'fixture' } }, {
+		headers: { Authorization: 'Bearer client-secret' }
+	});
+	assert.equal(response.result.isError, true);
+	assert.match(response.result.content[0].text, /\[redacted\]/);
+	assert.doesNotMatch(JSON.stringify(response), /client-secret|server-default/);
+});
+
+test('HTTPS uses the same handler and verifies the configured certificate', async t => {
+	const cert = Path.join(__dirname, 'fixtures/mcp/localhost.crt');
+	const key = Path.join(__dirname, 'fixtures/mcp/localhost.key');
+	const service = await start(factory(tools, createContext({})), {
+		...configuration({}, {}), port: 0, tls_cert: cert, tls_key: key, log() {}
+	});
+	t.after(() => service.close());
+	const response = await new Promise((resolve, reject) => {
+		const request = https.request({
+			hostname: '127.0.0.1', port: service.address.port, path: '/mcp', method: 'POST',
+			ca: fs.readFileSync(cert), headers: { Authorization: 'Bearer fixture-key', 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }
+		}, response => {
+			let body = '';
+			response.on('data', chunk => { body += chunk; });
+			response.on('end', () => resolve({ status: response.statusCode, body }));
+		});
+		request.on('error', reject);
+		request.end(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }));
+	});
+	assert.equal(response.status, 200);
+	assert.match(response.body, /create_event/);
+});
+
+test('HTTP disconnect cancels the tool context before its next upstream call', async t => {
+	let entered;
+	const entering = new Promise(resolve => { entered = resolve; });
+	let cancelled;
+	const cancellation = new Promise(resolve => { cancelled = resolve; });
+	let calls = 0;
+	const context = createContext({ get_event: async () => { calls++; return { data: { code: 0 } }; } });
+	const custom = new Map(tools);
+	const original = tools.get('get_event');
+	custom.set('get_event', { ...original, async run(args, invocation) {
+		entered();
+		await new Promise(resolve => invocation.signal.addEventListener('abort', resolve, { once: true }));
+		await assert.rejects(invocation.callAPI('get_event', { id: args.id }), /cancelled/);
+		cancelled();
+		return {};
+	} });
+	const service = await start(factory(custom, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const request = http.request({
+		hostname: '127.0.0.1', port: service.address.port, path: '/mcp', method: 'POST',
+		headers: { Authorization: 'Bearer fixture-key', 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }
+	});
+	request.on('error', () => {});
+	request.end(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'get_event', arguments: { id: 'e1' } } }));
+	await entering;
+	request.destroy();
+	await Promise.race([cancellation, new Promise((resolve, reject) => { const timer = setTimeout(() => reject(new Error('Cancellation did not reach the tool')), 2000); timer.unref(); })]);
+	assert.equal(calls, 0);
+});
+
+test('new HTTP mutations use each client key and read-only mode rejects every write tool', async t => {
+	const calls = [];
+	const context = createContext({ update_ticket: async (params, options) => {
+		const key = options.headers['X-API-Key'];
+		calls.push({ key, params });
+		if (key === 'restricted-key') return { data: { code: 'access', description: 'Permission denied' } };
+		return { data: { code: 0, ticket: { id: params.id, status: params.status } } };
+	} }, { api_key: 'server-key' });
+	const service = await start(factory(tools, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const replies = await Promise.all(['allowed-key', 'restricted-key'].map(key => httpRPC(url, 'tools/call', {
+		name: 'update_ticket', arguments: { id: 't1', changes: { status: 'closed' } }
+	}, { modern: true, headers: { Authorization: 'Bearer ' + key } })));
+	assert.equal(replies[0].result.structuredContent.ticket.status, 'closed');
+	assert.equal(replies[1].result.isError, true);
+	assert.match(replies[1].result.content[0].text, /Permission denied/);
+	assert.deepEqual(calls.map(call => call.key).sort(), ['allowed-key', 'restricted-key']);
+	
+	let forbiddenCalls = 0;
+	const readOnly = createContext(new Proxy({}, { get() { return async () => { forbiddenCalls++; throw new Error('Must not call the SDK'); }; } }), { read_only: true });
+	const readonlyService = await start(factory(tools, readOnly), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => readonlyService.close());
+	const readonlyURL = 'http://127.0.0.1:' + readonlyService.address.port + '/mcp';
+	const headers = { Authorization: 'Bearer readonly-key' };
+	const listing = await httpRPC(readonlyURL, 'tools/list', {}, { headers });
+	assert.deepEqual(listing.result.tools.map(tool => tool.name).sort(), ['get_event', 'get_event_options', 'get_job', 'list_events', 'list_servers', 'search_alerts', 'search_jobs', 'search_snapshots']);
+	for (const tool of tools.values()) {
+		if (tool.description.annotations.readOnlyHint) continue;
+		const reply = await httpRPC(readonlyURL, 'tools/call', { name: tool.description.name, arguments: {} }, { headers });
+		assert.ok(reply.error || reply.result.isError, tool.description.name);
+	}
+	assert.equal(forbiddenCalls, 0);
+});

package/test/mcp-stdio-unit.test.js

@@ -0,0 +1,194 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { spawnSync } = require('node:child_process');
+const { httpRPC, stdioClient } = require('./helpers/mcp.js');
+
+test('STDIO uses the real CLI and SDK with protocol-only stdout and clean EOF', async t => {
+	let calls = 0;
+	const backend = http.createServer((request, response) => {
+		calls++;
+		assert.equal(request.headers['x-api-key'], 'fixture-key');
+		assert.ok(request.url.startsWith('/api/app/get_event/v1'));
+		response.setHeader('Content-Type', 'application/json');
+		response.end(JSON.stringify({ code: 0, event: { id: 'fixture', revision: 2 } }));
+	});
+	await new Promise(resolve => backend.listen(0, '127.0.0.1', resolve));
+	t.after(() => new Promise(resolve => { backend.close(resolve); backend.closeAllConnections(); }));
+	const client = stdioClient(t, { XYOPS_BASE_URL: 'http://127.0.0.1:' + backend.address().port, XYOPS_API_KEY: 'fixture-key', XYOPS_RETRIES: '4' }, ['mcp', 'stdio', '--verbose', '--debug', '--read-only']);
+	assert.ok((await client.initialize()).result);
+	const listing = await client.request('tools/list');
+	assert.equal(listing.result.tools.length, 8);
+	assert.equal((await client.call('get_event', { id: 'fixture' })).result.structuredContent.event.revision, 2);
+	assert.equal(calls, 1);
+	const rejected = await client.call('run_event', { id: 'fixture' });
+	assert.ok(rejected.error || rejected.result.isError);
+	assert.equal(calls, 1);
+	client.child.stdin.end();
+	const [code] = await client.exit;
+	assert.equal(code, 0);
+	assert.ok(client.lines.every(line => JSON.parse(line).jsonrpc === '2.0'));
+	assert.ok(!client.stderr().includes('fixture-key'));
+});
+
+test('named HTTP options and local help do not contact xyOps', () => {
+	for (const args of [['mcp', 'serve', '--help'], ['mcp', '--help']]) {
+		const response = spawnSync(process.execPath, ['index.js', ...args], { encoding: 'utf8', env: { ...process.env, XYOPS_API_KEY: '', XYOPS_BASE_URL: '' } });
+		assert.equal(response.status, 0);
+		assert.match(response.stdout, /--port 8080/);
+	}
+	const response = spawnSync(process.execPath, ['index.js', 'mcp', 'serve', '8080'], { encoding: 'utf8' });
+	assert.equal(response.status, 1);
+	assert.equal(response.stdout, '');
+	assert.match(response.stderr, /--port/);
+});
+
+for (const { host, urlHost } of [{ host: '127.0.0.1', urlHost: '127.0.0.1' }, { host: '::1', urlHost: '[::1]' }]) {
+	test('HTTP CLI starts and shuts down on ' + host, { timeout: 15000 }, async t => {
+		// Reserve an available port before launching the actual CLI process. Tool
+		// calls use the real SDK with no process-wide API key configured.
+		const backend = http.createServer((request, response) => {
+			response.setHeader('Content-Type', 'application/json');
+			const id = new URL(request.url, 'http://fixture').searchParams.get('id');
+			assert.equal(request.headers['x-api-key'], id + '-key');
+			response.end(JSON.stringify({ code: 0, event: { id } }));
+		});
+		await new Promise(resolve => backend.listen(0, '127.0.0.1', resolve));
+		t.after(() => new Promise(resolve => { backend.close(resolve); backend.closeAllConnections(); }));
+		const reservation = http.createServer();
+		try {
+			await new Promise((resolve, reject) => {
+				reservation.once('error', reject);
+				reservation.listen(0, host, resolve);
+			});
+		}
+		catch (err) {
+			// Some test hosts have IPv6 disabled. Skip only that explicit case.
+			if (host === '::1' && ['EADDRNOTAVAIL', 'EAFNOSUPPORT'].includes(err.code)) return t.skip('IPv6 loopback unavailable');
+			throw err;
+		}
+		const port = reservation.address().port;
+		await new Promise(resolve => reservation.close(resolve));
+		const client = stdioClient(t, {
+			XYOPS_BASE_URL: 'http://127.0.0.1:' + backend.address().port, XYOPS_API_KEY: '',
+			XYOPS_MCP: JSON.stringify({ host: '127.0.0.1' })
+		}, ['mcp', 'serve', '--host', host, '--port', String(port), '--read-only']);
+		await new Promise((resolve, reject) => {
+			const timer = setTimeout(() => reject(new Error('HTTP startup timeout: ' + client.stderr())), 10000);
+			client.child.stderr.on('data', () => {
+				if (client.stderr().includes('Listening at ')) { clearTimeout(timer); resolve(); }
+			});
+			client.exit.then(() => { clearTimeout(timer); reject(new Error('CLI exited before startup: ' + client.stderr())); });
+		});
+		const url = 'http://' + urlHost + ':' + port + '/mcp';
+		assert.ok(client.stderr().includes('Listening at ' + url));
+		const listing = await httpRPC(url, 'tools/list', {}, {
+			modern: true, headers: { Authorization: 'Bearer fixture-token' }
+		});
+		assert.equal(listing.result.tools.length, 8);
+		assert.equal((await fetch(url)).status, 401);
+		// Binding IPv6 must not weaken the Host allowlist.
+		const rejectedHost = await new Promise((resolve, reject) => {
+			const req = http.get(url, { headers: { Host: 'evil.example', Authorization: 'Bearer fixture-key' } }, response => {
+				response.resume();
+				resolve(response.statusCode);
+			});
+			req.on('error', reject);
+		});
+		assert.equal(rejectedHost, 403);
+		const replies = await Promise.all(['first', 'second'].map((id, index) => httpRPC(url, 'tools/call', {
+			name: 'get_event', arguments: { id }
+		}, { modern: !!index, headers: { Authorization: 'Bearer ' + id + '-key' } })));
+		assert.deepEqual(replies.map(reply => reply.result.structuredContent.event.id), ['first', 'second']);
+		assert.equal(client.child.kill('SIGTERM'), true);
+		const [code, signal] = await client.exit;
+		if (process.platform === 'win32') {
+			// Windows force-terminates a child sent SIGTERM, without running its
+			// signal handler. Node reports signal termination, not exit code 0.
+			assert.equal(code, null);
+			assert.equal(signal, 'SIGTERM');
+		}
+		else {
+			// POSIX delivers SIGTERM to the CLI's graceful shutdown handler.
+			assert.equal(code, 0);
+			assert.equal(signal, null);
+		}
+		assert.deepEqual(client.lines, []);
+	});
+}
+
+test('ticket and monitoring tools use real SDK routes and validated STDIO inputs', async t => {
+	const requests = [];
+	const backend = http.createServer((request, response) => {
+		let body = '';
+		request.on('data', chunk => { body += chunk; });
+		request.on('end', () => {
+			const url = new URL(request.url, 'http://fixture');
+			const name = url.pathname.split('/')[3];
+			const params = body ? JSON.parse(body) : Object.fromEntries(url.searchParams);
+			requests.push({ name, method: request.method, params });
+			assert.equal(request.headers['x-api-key'], 'fixture-key');
+			assert.match(request.headers['user-agent'], /xyOps MCP/);
+			let result = { code: 0 };
+			switch (name) {
+				case 'create_ticket':
+				case 'update_ticket':
+				case 'add_ticket_change':
+					result.ticket = { id: 't1', num: 1, subject: 'Test', status: params.status || 'open', changes: params.change ? [{ ...params.change, id: 'c1', username: 'fixture-key', date: 123 }] : [] };
+					break;
+				case 'delete_ticket': break;
+				case 'create_snapshot':
+				case 'create_group_snapshot': result.id = 'sn1'; break;
+				case 'get_active_servers': result.rows = [{ id: 's1', hostname: 'worker', groups: ['main'], enabled: true }]; result.list = { length: 1 }; break;
+				case 'search_alerts':
+				case 'search_snapshots': result.rows = [{ id: 'record1' }]; result.list = { length: 1 }; break;
+				default: result = { code: 'test', description: 'Unexpected route ' + name };
+			}
+			response.setHeader('Content-Type', 'application/json');
+			response.end(JSON.stringify(result));
+		});
+	});
+	await new Promise(resolve => backend.listen(0, '127.0.0.1', resolve));
+	t.after(() => new Promise(resolve => { backend.close(resolve); backend.closeAllConnections(); }));
+	const client = stdioClient(t, { XYOPS_BASE_URL: 'http://127.0.0.1:' + backend.address().port, XYOPS_API_KEY: 'fixture-key', XYOPS_MCP: '{}' });
+	await client.initialize();
+	const listing = await client.request('tools/list');
+	assert.equal(listing.result.tools.length, 17);
+	const invoke = async (name, args) => {
+		const reply = await client.call(name, args);
+		assert.ok(reply.result && !reply.result.isError, JSON.stringify(reply));
+		return reply.result.structuredContent;
+	};
+	assert.equal((await invoke('create_ticket', { ticket: { subject: 'Test', body: '**Markdown**' } })).ticket.id, 't1');
+	assert.deepEqual(requests.at(-1), { name: 'create_ticket', method: 'POST', params: { subject: 'Test', body: '**Markdown**' } });
+	await invoke('update_ticket', { id: 't1', changes: { status: 'closed', assignees: [] } });
+	assert.deepEqual(requests.at(-1).params, { id: 't1', status: 'closed', assignees: [] });
+	assert.equal((await invoke('comment_ticket', { id: 't1', body: 'Comment' })).comment.username, 'fixture-key');
+	assert.deepEqual(requests.at(-1).params, { id: 't1', change: { type: 'comment', body: 'Comment' } });
+	assert.equal((await invoke('delete_ticket', { id: 't1' })).deleted, true);
+	await invoke('search_alerts', { query: 'active:true server:s1', limit: 2 });
+	assert.deepEqual(requests.at(-1), { name: 'search_alerts', method: 'GET', params: { query: 'active:true server:s1', offset: '0', limit: '2', sort_by: '_id', sort_dir: '-1' } });
+	await invoke('search_snapshots', {});
+	assert.ok(!('verbose' in requests.at(-1).params));
+	await invoke('search_snapshots', { verbose: true, limit: 1 });
+	assert.equal(requests.at(-1).params.verbose, '1');
+	assert.equal((await invoke('list_servers', { group: 'main' })).rows[0].id, 's1');
+	await invoke('take_snapshot', { server: 's1' });
+	assert.deepEqual(requests.at(-1), { name: 'create_snapshot', method: 'POST', params: { server: 's1' } });
+	await invoke('take_snapshot', { group: 'main' });
+	assert.deepEqual(requests.at(-1), { name: 'create_group_snapshot', method: 'POST', params: { group: 'main' } });
+	
+	// Validate through the registered protocol schema as well as the registry.
+	const count = requests.length;
+	for (const [name, args] of [
+		['take_snapshot', {}], ['take_snapshot', { server: 's1', group: 'main' }],
+		['create_ticket', { ticket: { subject: 'Test', username: 'admin' } }],
+		['comment_ticket', { id: 't1', body: ' ' }]
+	]) {
+		const reply = await client.call(name, args);
+		assert.ok(reply.error || reply.result.isError, name);
+	}
+	assert.equal(requests.length, count);
+	client.child.stdin.end();
+	assert.equal((await client.exit)[0], 0);
+});