@pixlcore/xycli 1.1.1 → 1.2.1

package/test/README.md

@@ -12,6 +12,8 @@ Use an xyOps version that supports restoring API key IDs, hashes, and masks thro
 
 ## Running Tests
 
+For MCP-only coverage, run `node test.js mcp` against the configured local server. It creates disposable events, a restricted API key and a draft ticket, runs an echo job, checks both transports, exercises ticket mutations, searches alert invocations, takes server/group snapshots, and cleans up. Monitoring coverage requires a connected worker in a group with a saved monitoring sample. Ticket fixtures remain drafts to suppress notifications; only snapshots created by the MCP suite are deleted, with removal verified. The offline MCP suites are included in `npm run test:offline` and use a fake upstream API plus local transport connections.
+
 Run every suite, one at a time:
 
 ```sh
@@ -57,6 +59,7 @@ node --test test/config.test.js test/sync-buckets-unit.test.js test/sync-unit.te
 | `config` | Offline user-file updates, inherited-setting isolation, missing-file creation, dotted edits, permissions, and read-only display |
 | `events` | CRUD, dependency filters, nested edits, triggers, actions, limits, fields, validation, and help |
 | `jobs` | Event launch, parameter and input overrides, completed reports, output logs, search, rerun, deletion, validation, and help |
+| `jobs-follow-unit` | Offline live-follow retry chains, queued and already-completed retries, completed-job lookups, and stopping without a retry |
 | `log` | Log searches, latest rows, matching, column selection, native output |
 | `markdown` | Terminal rendering, inline formatting inside list items, typographic bullets, and output margins |
 | `monitors` | CRUD, groups, evaluator requests, type conversions, validation, help |

package/test/config.test.js

@@ -134,3 +134,25 @@ test('config display shows effective environment overrides without writing the u
 	assert.doesNotMatch(output, /fixture-key/);
 	assert.equal(fs.readFileSync(fixture.file, 'utf8'), original);
 });
+
+test('config parses and exports JSON objects and arrays for any setting', t => {
+	const fixture = createConfigFixture(t, { sync: { up: ['events'] }, targets: ['server1'] });
+	const output = fixture.run([]);
+	assert.match(output, /"sync":/);
+	assert.match(output, /"targets":/);
+	
+	// Two loads verify the loader's config-to-environment round trip for any
+	// nested setting, while retaining the existing scalar conversions.
+	const script = "const loader=require('./lib/config.js'); const one={},two={}; loader.loadConfig.call(one); loader.loadConfig.call(two); process.stdout.write(JSON.stringify({ object:two.config.fixture_object,array:two.config.fixture_array,flag:two.config.fixture_flag,number:two.config.fixture_number,text:two.config.fixture_text }));";
+	const response = spawnSync(process.execPath, ['-e', script], {
+		cwd: Path.resolve(__dirname, '..'), encoding: 'utf8',
+		env: { ...process.env, XYOPS_FIXTURE_OBJECT: ' {"nested":{"enabled":true}} ', XYOPS_FIXTURE_ARRAY: '[1,"two",false]', XYOPS_FIXTURE_FLAG: 'false', XYOPS_FIXTURE_NUMBER: '2.5', XYOPS_FIXTURE_TEXT: 'ordinary string' }
+	});
+	assert.equal(response.status, 0);
+	assert.deepEqual(JSON.parse(response.stdout), { object: { nested: { enabled: true } }, array: [1, 'two', false], flag: false, number: 2.5, text: 'ordinary string' });
+	const malformed = spawnSync(process.execPath, ['-e', script], {
+		cwd: Path.resolve(__dirname, '..'), encoding: 'utf8', env: { ...process.env, XYOPS_FIXTURE_OBJECT: '{broken}' }
+	});
+	assert.notEqual(malformed.status, 0);
+	assert.match(malformed.stderr, /Failed to parse JSON from environment variable: XYOPS_FIXTURE_OBJECT/);
+});

package/test/fixtures/mcp/localhost.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJTCCAg2gAwIBAgIUE+q8i5Huab9cIusPdyyM1jSo1D0wDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MTAyNDIxMTQ1NloXDTM2MTAy
+MTIxMTQ1NlowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAp/9tYH7BYj0HsppRCLpWjIGIboi3tuoPhC57QcPu2TxD
+YSoHb6rS7PgFccFdGr8bOhfm8f5IKxZLS78hfaNDx499DTX/NaU7pR47vR/Ryxbm
+P1wojuo53N3GoMXrsAM6AK/2KbK1R1IWlMD6zQ5rsArtpDTEhQdxbkK2Qgjp3qnz
+suXgmxlsJ0m/8OACavuKdieNynl6CdJ75+tJn4AV0jqaHV7CDk7QyW2Yg6SDCZVD
+lk4Ftayxc05CPAlh8WOPnvUTIXk2SEpA3p59D/hH9yA2izvEMTG45pOItoJwtFvG
+FZc1DPlng3ie1A/lUKEtoA+5lk2A91Jg/sIJUxirkQIDAQABo28wbTAdBgNVHQ4E
+FgQUlfqOYOxeA5j18RO6+hQZySE7TvQwHwYDVR0jBBgwFoAUlfqOYOxeA5j18RO6
++hQZySE7TvQwDwYDVR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SH
+BH8AAAEwDQYJKoZIhvcNAQELBQADggEBAIhp1ckadusVEbdyiWRF+GyX3rUs0bDq
+9dgMfY1b5cYpdDEv/oMCQvAMWpy70mQb8hq4ffpNLLuzolF4mzt5S+PiR8LYBacY
+E7iIFQtJ4WpI+50xdxJT2xx1Bk1KIyt3au9T99oVljUJGejYC4MYQR5pCRY83I/h
+apUEb6NPxgFwfaD+BGnCG1INQvPc6LRVuat9M72KGziBUM5OtERuJpgA/t8EbZXA
+rnGA9XF9q8c56BpwYlrpvM3pjeIcH3sRJ3Wx6wtp6hGPa51EnoqrpT5tmE994miG
+2vnHalGtQISt9Ru6F9sxlR7mqh441TpAxYDa42MmDsXxhKTRcY7xOww=
+-----END CERTIFICATE-----

package/test/fixtures/mcp/localhost.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCn/21gfsFiPQey
+mlEIulaMgYhuiLe26g+ELntBw+7ZPENhKgdvqtLs+AVxwV0avxs6F+bx/kgrFktL
+vyF9o0PHj30NNf81pTulHju9H9HLFuY/XCiO6jnc3cagxeuwAzoAr/YpsrVHUhaU
+wPrNDmuwCu2kNMSFB3FuQrZCCOneqfOy5eCbGWwnSb/w4AJq+4p2J43KeXoJ0nvn
+60mfgBXSOpodXsIOTtDJbZiDpIMJlUOWTgW1rLFzTkI8CWHxY4+e9RMheTZISkDe
+nn0P+Ef3IDaLO8QxMbjmk4i2gnC0W8YVlzUM+WeDeJ7UD+VQoS2gD7mWTYD3UmD+
+wglTGKuRAgMBAAECggEACTWewLFyLHkoA4nOHhUI9ZQ27x2eOfAZgFIuqOudcQSK
+tQ2MHCUDLGu+8KjRpSELfw3HDUZhR8C7HqCQV3DXIF4kqXq8+NXhWoCOdHmwEzAN
+gzUBdtmEPoVchCfAGdqzbUziyQ+7kaNVtZCMBH22jY9WeQVOLfS7KnjhwOZNhnU3
+vpstAKtdnc4tbxqT+z1b2clqvhO2fIFVPi4gPFM9oTvjSVyq51qoQB7nvnarJJSd
+u7WFJXvvH9gY2yLdS1/efwxNG6mxkaNq6SbKKF9/WaqLNo4qctFAdGZ486LrSQZf
+FiPOC7MCi9+UViy04cFebdibgmi9eAMiiIEdvDvJGQKBgQDnz81WrV2w9v0KGIeu
+yByIoNv4apIM1fggM+0xu4oroD2Xakdh5VlGREJ7eHrPqQRTFtKH11LcYKqC7Zjs
+fxmeNwb6fLZADX1cxKPjaUJXj4lK3HZC5VUM0YxC+iHOAZhmuHR3RbYj5ur/kXSh
+6UoRRQvIllXWo2Icf5X9xhZGCwKBgQC5hwPChGPsUc4F/QRzturaXt88e50vViny
+Fqf8csujqk2isxg2NlbPcNlqeQ7jjW1iS3iUmVhpTThiri4cvTcLqG5xAQFLZ58a
++crcN3sBkNSpMYwYkxeU7MYYaLtZsDjv+kN1Xq2n7MdfSiIBPrTSx624QUSVUy7W
+1dg7DceiUwKBgQDZ5Y/rcMzHwnK6IbKwjTOdDi+Ww34DiMFSa90CyXkoZtheUq1E
+jRQso48mhmpSdlo1TBebTsB5nHfK2FHNw+8ttCXgIIgjj0qOf9xZsCCHM8nmz3Ju
+kSkwAmzorDxIa2F49NutHZ8HAlFU58INS7+umgtogj+voSZhCWDRCXj4XwKBgCOX
+uGvv9C+ZPho+AUWl2QaN3uv+lxhGwoNUP2QaLeE3Qe+txj5YTG09rChWEzoqnsqV
+ygtQI/sHuoKMAgK3dkEBTjbVx4bM2WRWecmnxyx0uae//q2UQpjql9KE/TRmr3Wy
+oJB62nv13AX29fEhM5Wggz5vHxY6wCitG++wZBVLAoGAWB2yh8ICGTfcgfVFxTNv
+fj54c/EnZXP6OxQ3Isz7tYy/aNDFubcQPhdjMS+bd5q0W7WMiP4NBv8+lkMh0sWx
+Yawi8CYIFTcV8fYmXV3ord2D+NbcVfobcf9UE2W7zbv15nZ1+LrICimIlcPfX83R
+7PlB6dvbKNLI//9+yXExN7w=
+-----END PRIVATE KEY-----

package/test/helpers/mcp.js

@@ -0,0 +1,78 @@
+// Small wire-level MCP clients keep the tests independent of another SDK dep.
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const readline = require('node:readline');
+const Path = require('node:path');
+
+async function decode(response) {
+	const body = await response.text();
+	if (response.headers.get('content-type')?.includes('text/event-stream')) {
+		const line = body.split('\n').find(line => line.startsWith('data: '));
+		return JSON.parse(line.slice(6));
+	}
+	return JSON.parse(body);
+}
+
+async function httpRPC(url, method, params = {}, options = {}) {
+	const modern = options.modern;
+	if (modern) params = { ...params, _meta: { 'io.modelcontextprotocol/protocolVersion': '2026-07-28', 'io.modelcontextprotocol/clientCapabilities': {} } };
+	const response = await fetch(url, {
+		method: 'POST', signal: AbortSignal.timeout(10000),
+		headers: {
+			'Content-Type': 'application/json', Accept: 'application/json, text/event-stream',
+			...(modern ? { 'MCP-Protocol-Version': '2026-07-28', 'Mcp-Method': method, ...(params.name ? { 'Mcp-Name': params.name } : {}) } : {}),
+			...options.headers
+		}, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params })
+	});
+	return decode(response);
+}
+
+function stdioClient(t, env = {}, args = ['mcp', 'stdio']) {
+	const child = spawn(process.execPath, [Path.resolve(__dirname, '../../index.js'), ...args], {
+		stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, ...env }
+	});
+	let stderr = '';
+	const lines = [];
+	const pending = new Map();
+	let id = 0;
+	child.stderr.on('data', data => { stderr += data; });
+	const exit = once(child, 'exit');
+	const reader = readline.createInterface({ input: child.stdout });
+	reader.on('line', line => {
+		lines.push(line);
+		let message;
+		try { message = JSON.parse(line); }
+		catch (err) {
+			for (const call of pending.values()) call.reject(new Error('Non-JSON stdout: ' + line));
+			return;
+		}
+		pending.get(message.id)?.resolve(message);
+	});
+	t.after(async () => {
+		if (child.exitCode === null && child.signalCode === null) child.kill('SIGTERM');
+		await exit;
+	});
+	
+	return {
+		child, lines, exit, stderr: () => stderr,
+		request(method, params = {}) {
+			const requestId = ++id;
+			return new Promise((resolve, reject) => {
+				const timer = setTimeout(() => { pending.delete(requestId); reject(new Error('MCP response timeout: ' + method + '; ' + stderr)); }, 10000);
+				pending.set(requestId, {
+					resolve(value) { clearTimeout(timer); pending.delete(requestId); resolve(value); },
+					reject(error) { clearTimeout(timer); pending.delete(requestId); reject(error); }
+				});
+				child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id: requestId, method, params }) + '\n');
+			});
+		},
+		async initialize() {
+			return this.request('initialize', { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'xycli-test', version: '1' } });
+		},
+		async call(name, args) {
+			return this.request('tools/call', { name, arguments: args });
+		}
+	};
+}
+
+module.exports = { decode, httpRPC, stdioClient };

package/test/jobs-follow-unit.test.js

@@ -0,0 +1,107 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const cli = require('pixl-cli');
+const jobs = require('../lib/jobs.js');
+
+cli.global();
+
+function makeFollower(t, records) {
+	// Exercise the real command transitions with an offline SDK stub.  Streaming
+	// finishes an attempt, but only getJob exposes its additional-job links.
+	const streamed = [];
+	const results = [];
+	const context = {
+		...jobs,
+		args: { id: records[0].id },
+		format: 'json',
+		async getMultiple() {},
+		api: {
+			async getJob({ id }) {
+				const job = records.find( item => item.id === id );
+				assert.ok(job, 'Unexpected job lookup: ' + id);
+				return { data: { job: { ...job } } };
+			},
+			async streamJob({ id }, callback) {
+				const job = records.find( item => item.id === id );
+				streamed.push(id);
+				job.final = true;
+				callback({ id, final: true, code: job.code });
+				return {};
+			}
+		},
+		jsonOutput(job) { results.push(job.id); },
+		die(message) { throw new Error(message); },
+		color() { return cli.chalk.white; },
+		printBoxList() {}
+	};
+	
+	// Keep terminal rendering out of these tests, including progress timers.
+	for (const name of ['start', 'update', 'end']) t.mock.method(cli.progress, name, () => {});
+	for (const name of ['print', 'println', 'verboseln']) t.mock.method(global, name, () => {});
+	for (const name of ['getNiceJob', 'getNiceJobEvent', 'getNiceCategory', 'getNicePlugin',
+		'getNiceTargets', 'getNiceServer', 'getNiceAlgo', 'getNiceJobSource',
+		'getRelativeDateTime', 'getNiceJobState']) {
+		context[name] = () => '';
+	}
+	
+	return { context, streamed, results };
+}
+
+test('live follow crosses completed and queued retries, ignoring unrelated jobs', async t => {
+	const { context, streamed, results } = makeFollower(t, [
+		{ id: 'initial', code: 1, jobs: [{ id: 'other', reason: 'action' }, { id: 'retry1', reason: 'retry' }] },
+		{ id: 'retry1', final: true, code: 'warning', jobs: [{ id: 'retry2', reason: 'retry' }] },
+		{ id: 'retry2', state: 'queued', code: 0 }
+	]);
+	
+	await context.cmd_stream_job();
+	assert.deepEqual(streamed, ['initial', 'retry2']);
+	assert.deepEqual(results, ['retry2']);
+});
+
+test('directly opening an active job also follows its retry', async t => {
+	const { context, streamed, results } = makeFollower(t, [
+		{ id: 'initial', code: 1, jobs: [{ id: 'retry', reason: 'retry' }] },
+		{ id: 'retry', code: 2 }
+	]);
+	
+	await context.cmd_get_job();
+	assert.deepEqual(streamed, ['initial', 'retry']);
+	assert.deepEqual(results, ['retry']);
+});
+
+test('follow catches retries when the initial job finishes before streaming starts', async t => {
+	const { context, streamed, results } = makeFollower(t, [
+		{ id: 'initial', final: true, code: 1, jobs: [{ id: 'retry', reason: 'retry' }] },
+		{ id: 'retry', code: 0 }
+	]);
+	
+	await context.cmd_stream_job();
+	assert.deepEqual(streamed, ['retry']);
+	assert.deepEqual(results, ['retry']);
+});
+
+test('opening a completed job preserves the requested attempt', async t => {
+	const { context, streamed, results } = makeFollower(t, [
+		{ id: 'initial', final: true, code: 1, jobs: [{ id: 'retry', reason: 'retry' }] }
+	]);
+	
+	await context.cmd_get_job();
+	assert.deepEqual(streamed, []);
+	assert.deepEqual(results, ['initial']);
+});
+
+test('follow stops on success or failure without a valid retry link', async t => {
+	for (const record of [
+		{ code: 0, jobs: [{ id: 'other', reason: 'retry' }] },
+		{ code: 1 },
+		{ code: 1, jobs: [] },
+		{ code: 1, jobs: {} },
+		{ code: 1, jobs: [null, { reason: 'retry' }, { id: 'other', reason: 'action' }] }
+	]) {
+		const { context, streamed, results } = makeFollower(t, [{ id: 'initial', ...record }]);
+		await context.cmd_stream_job();
+		assert.deepEqual(streamed, ['initial']);
+		assert.deepEqual(results, ['initial']);
+	}
+});

package/test/mcp-http-unit.test.js

@@ -0,0 +1,188 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const https = require('node:https');
+const fs = require('node:fs');
+const Path = require('node:path');
+const { configuration } = require('../lib/mcp.js');
+const { createContext } = require('../lib/mcp/context.js');
+const factory = require('../lib/mcp/server.js');
+const start = require('../lib/mcp/transports/http.js');
+const tools = require('../lib/mcp/registry.js')();
+const { httpRPC } = require('./helpers/mcp.js');
+
+test('HTTP serves both protocol generations, validates calls and rejects unauthorized access', async t => {
+	let calls = 0;
+	const context = createContext({ get_event: async (params, options) => { calls++; assert.equal(options.headers['X-API-Key'], 'test-token'); return { data: { code: 0, event: { id: params.id, revision: 1 } } }; } }, { read_only: true, api_key: 'server-key-must-not-be-used' });
+	const options = { ...configuration({}, {}), port: 0, log() {} };
+	const service = await start(factory(tools, context), options);
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const headers = { Authorization: 'Bearer test-token' };
+	for (const authorization of ['', 'Basic abc', 'Bearer', 'Bearer ', 'Bearer key extra']) {
+		assert.equal((await fetch(url, { headers: { Authorization: authorization } })).status, 401);
+	}
+	assert.equal(calls, 0);
+	assert.equal((await fetch(url, { headers: { ...headers, Origin: 'https://evil.example' } })).status, 403);
+	assert.equal((await fetch(url + '/other', { headers })).status, 404);
+	
+	for (const modern of [false, true]) {
+		const listing = await httpRPC(url, 'tools/list', {}, { headers, modern });
+		assert.equal(listing.result.tools.length, 8);
+		assert.ok(listing.result.tools.every(tool => tool.annotations.readOnlyHint));
+		const response = await httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id: 'e1' } }, { headers, modern });
+		assert.equal(response.result.structuredContent.event.id, 'e1');
+	}
+	assert.equal(calls, 2);
+	const invalid = await httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id: 'bad/id' } }, { headers });
+	assert.ok(invalid.error || invalid.result.isError);
+	const forbidden = await httpRPC(url, 'tools/call', { name: 'delete_event', arguments: { id: 'e1' } }, { headers });
+	assert.ok(forbidden.error || forbidden.result.isError);
+	assert.equal(calls, 2);
+	const malformed = await fetch(url, { method: 'POST', headers: { ...headers, 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }, body: '{broken' });
+	assert.equal(malformed.status, 400);
+	// Send the declared size first: the adapter can reject it before reading a
+	// body, without racing a megabyte upload against the closed connection.
+	const oversizedStatus = await new Promise((resolve, reject) => {
+		const req = http.request(url, { method: 'POST', headers: { ...headers, 'Content-Length': options.max_request_bytes + 1 } }, response => {
+			response.resume();
+			response.on('end', () => { resolve(response.statusCode); req.destroy(); });
+		});
+		req.on('error', reject);
+		req.flushHeaders();
+	});
+	assert.equal(oversizedStatus, 413);
+	
+	// Exercise the real Host header instead of trusting URL-only validation.
+	const status = await new Promise((resolve, reject) => {
+		const req = http.get(url, { headers: { ...headers, Host: 'evil.example' } }, response => { response.resume(); resolve(response.statusCode); });
+		req.on('error', reject);
+	});
+	assert.equal(status, 403);
+	await service.close();
+});
+
+test('concurrent HTTP tools keep their keys across multiple API calls', async t => {
+	const calls = [];
+	const context = createContext({ get_event: async (params, options) => {
+		assert.equal(options.headers['X-API-Key'], params.id + '-key');
+		calls.push(options.headers['X-API-Key']);
+		await new Promise(resolve => setTimeout(resolve, params.id === 'slow' ? 25 : 1));
+		return { data: { code: 0, event: { id: params.id } } };
+	} }, { api_key: 'server-key-must-not-be-used' });
+	const custom = new Map(tools);
+	const original = tools.get('get_event');
+	custom.set('get_event', { ...original, async run(args, invocation) {
+		await original.run(args, invocation);
+		return original.run(args, invocation);
+	} });
+	const service = await start(factory(custom, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const replies = await Promise.all(['slow', 'fast'].map(id => httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id } }, { headers: { Authorization: 'Bearer ' + id + '-key' } })));
+	assert.deepEqual(replies.map(reply => reply.result.structuredContent.event.id), ['slow', 'fast']);
+	assert.deepEqual(calls.sort(), ['fast-key', 'fast-key', 'slow-key', 'slow-key']);
+});
+
+test('HTTP tool errors redact the requesting client key', async t => {
+	const context = createContext({ get_event: async (params, options) => ({
+		err: 'Rejected key: ' + options.headers['X-API-Key']
+	}) }, { api_key: 'server-default' });
+	const service = await start(factory(tools, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const response = await httpRPC(url, 'tools/call', { name: 'get_event', arguments: { id: 'fixture' } }, {
+		headers: { Authorization: 'Bearer client-secret' }
+	});
+	assert.equal(response.result.isError, true);
+	assert.match(response.result.content[0].text, /\[redacted\]/);
+	assert.doesNotMatch(JSON.stringify(response), /client-secret|server-default/);
+});
+
+test('HTTPS uses the same handler and verifies the configured certificate', async t => {
+	const cert = Path.join(__dirname, 'fixtures/mcp/localhost.crt');
+	const key = Path.join(__dirname, 'fixtures/mcp/localhost.key');
+	const service = await start(factory(tools, createContext({})), {
+		...configuration({}, {}), port: 0, tls_cert: cert, tls_key: key, log() {}
+	});
+	t.after(() => service.close());
+	const response = await new Promise((resolve, reject) => {
+		const request = https.request({
+			hostname: '127.0.0.1', port: service.address.port, path: '/mcp', method: 'POST',
+			ca: fs.readFileSync(cert), headers: { Authorization: 'Bearer fixture-key', 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }
+		}, response => {
+			let body = '';
+			response.on('data', chunk => { body += chunk; });
+			response.on('end', () => resolve({ status: response.statusCode, body }));
+		});
+		request.on('error', reject);
+		request.end(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }));
+	});
+	assert.equal(response.status, 200);
+	assert.match(response.body, /create_event/);
+});
+
+test('HTTP disconnect cancels the tool context before its next upstream call', async t => {
+	let entered;
+	const entering = new Promise(resolve => { entered = resolve; });
+	let cancelled;
+	const cancellation = new Promise(resolve => { cancelled = resolve; });
+	let calls = 0;
+	const context = createContext({ get_event: async () => { calls++; return { data: { code: 0 } }; } });
+	const custom = new Map(tools);
+	const original = tools.get('get_event');
+	custom.set('get_event', { ...original, async run(args, invocation) {
+		entered();
+		await new Promise(resolve => invocation.signal.addEventListener('abort', resolve, { once: true }));
+		await assert.rejects(invocation.callAPI('get_event', { id: args.id }), /cancelled/);
+		cancelled();
+		return {};
+	} });
+	const service = await start(factory(custom, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const request = http.request({
+		hostname: '127.0.0.1', port: service.address.port, path: '/mcp', method: 'POST',
+		headers: { Authorization: 'Bearer fixture-key', 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }
+	});
+	request.on('error', () => {});
+	request.end(JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'get_event', arguments: { id: 'e1' } } }));
+	await entering;
+	request.destroy();
+	await Promise.race([cancellation, new Promise((resolve, reject) => { const timer = setTimeout(() => reject(new Error('Cancellation did not reach the tool')), 2000); timer.unref(); })]);
+	assert.equal(calls, 0);
+});
+
+test('new HTTP mutations use each client key and read-only mode rejects every write tool', async t => {
+	const calls = [];
+	const context = createContext({ update_ticket: async (params, options) => {
+		const key = options.headers['X-API-Key'];
+		calls.push({ key, params });
+		if (key === 'restricted-key') return { data: { code: 'access', description: 'Permission denied' } };
+		return { data: { code: 0, ticket: { id: params.id, status: params.status } } };
+	} }, { api_key: 'server-key' });
+	const service = await start(factory(tools, context), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => service.close());
+	const url = 'http://127.0.0.1:' + service.address.port + '/mcp';
+	const replies = await Promise.all(['allowed-key', 'restricted-key'].map(key => httpRPC(url, 'tools/call', {
+		name: 'update_ticket', arguments: { id: 't1', changes: { status: 'closed' } }
+	}, { modern: true, headers: { Authorization: 'Bearer ' + key } })));
+	assert.equal(replies[0].result.structuredContent.ticket.status, 'closed');
+	assert.equal(replies[1].result.isError, true);
+	assert.match(replies[1].result.content[0].text, /Permission denied/);
+	assert.deepEqual(calls.map(call => call.key).sort(), ['allowed-key', 'restricted-key']);
+	
+	let forbiddenCalls = 0;
+	const readOnly = createContext(new Proxy({}, { get() { return async () => { forbiddenCalls++; throw new Error('Must not call the SDK'); }; } }), { read_only: true });
+	const readonlyService = await start(factory(tools, readOnly), { ...configuration({}, {}), port: 0, log() {} });
+	t.after(() => readonlyService.close());
+	const readonlyURL = 'http://127.0.0.1:' + readonlyService.address.port + '/mcp';
+	const headers = { Authorization: 'Bearer readonly-key' };
+	const listing = await httpRPC(readonlyURL, 'tools/list', {}, { headers });
+	assert.deepEqual(listing.result.tools.map(tool => tool.name).sort(), ['get_event', 'get_event_options', 'get_job', 'list_events', 'list_servers', 'search_alerts', 'search_jobs', 'search_snapshots']);
+	for (const tool of tools.values()) {
+		if (tool.description.annotations.readOnlyHint) continue;
+		const reply = await httpRPC(readonlyURL, 'tools/call', { name: tool.description.name, arguments: {} }, { headers });
+		assert.ok(reply.error || reply.result.isError, tool.description.name);
+	}
+	assert.equal(forbiddenCalls, 0);
+});