@remnic/core 10.0.83 → 10.0.85

package/src/access-mcp.test.ts

@@ -10,12 +10,16 @@ import assert from "node:assert/strict";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { PassThrough } from "node:stream";
 import test from "node:test";
 
 import { EngramMcpServer } from "./access-mcp.js";
+import { MCP_STDIO_MAX_FRAME_BYTES } from "./access-mcp-frames.js";
+import { EngramAccessForbiddenError } from "./access-errors.js";
 import { tokenCapabilityStore } from "./access-token-capabilities.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import { parseConfig } from "./config.js";
+import { initLogger, resetLogger } from "./logger.js";
 import { readPair, writePair } from "./contradiction/contradiction-review.js";
 import type { StorageManager } from "./storage.js";
 
@@ -1451,3 +1455,145 @@ test("MCP external_wiki_search rejects an empty query before service dispatch",
   assert.equal(readMcpResult(response).isError, true);
   assert.equal(configRead, false);
 });
+
+// ===========================================================================
+// Issue #3225 C5 — tools/call catch-all must not leak unexpected Error.message
+// (paths from fs/backend). Intended typed access errors stay readable.
+// ===========================================================================
+
+function serviceWithRecallThrow(error: Error): EngramAccessService {
+  const service = makeMockService();
+  service.recall = async () => {
+    throw error;
+  };
+  return service;
+}
+
+test("MCP tools/call hides unexpected Error.message paths behind internal error", async () => {
+  const secretPath = "/home/secret/vault/token.pem";
+  const service = serviceWithRecallThrow(
+    new Error(`ENOENT: no such file or directory, open '${secretPath}'`),
+  );
+
+  const logLines: string[] = [];
+  initLogger(
+    {
+      info() {},
+      warn() {},
+      error(msg: string) {
+        logLines.push(msg);
+      },
+    },
+    false,
+    { timestamps: false },
+  );
+  try {
+    const server = new EngramMcpServer(service);
+    const outcome = readCallToolOutcome(
+      await server.handleRequest(makeToolRequest("engram.recall", { query: "anything" })),
+    );
+    assert.equal(outcome.isError, true);
+    assert.equal(outcome.text, "internal error");
+    assert.equal(outcome.text.includes(secretPath), false);
+    assert.ok(
+      logLines.some((line) => line.includes(secretPath)),
+      "server log must retain the unexpected detail",
+    );
+  } finally {
+    resetLogger();
+  }
+});
+
+test("MCP tools/call keeps intended EngramAccessInputError and ForbiddenError messages", async () => {
+  const inputOutcome = readCallToolOutcome(
+    await new EngramMcpServer(serviceWithRecallThrow(new EngramAccessInputError("memory not found: mem-42"))).handleRequest(
+      makeToolRequest("engram.recall", { query: "anything" }),
+    ),
+  );
+  assert.equal(inputOutcome.isError, true);
+  assert.equal(inputOutcome.text, "memory not found: mem-42");
+
+  const forbiddenOutcome = readCallToolOutcome(
+    await new EngramMcpServer(
+      serviceWithRecallThrow(new EngramAccessForbiddenError("token is not permitted to call operation: recall")),
+    ).handleRequest(makeToolRequest("engram.recall", { query: "anything" })),
+  );
+  assert.equal(forbiddenOutcome.isError, true);
+  assert.equal(forbiddenOutcome.text, "token is not permitted to call operation: recall");
+});
+
+// ===========================================================================
+// Issue #3225 N1 — stdio framing is bounded, refuses an oversized frame,
+// and keeps answering the frames that follow it.
+// ===========================================================================
+
+type StdioMessage = { id?: number | null; result?: object; error?: { message: string } };
+type StdioRequest = { jsonrpc: "2.0"; id: number; method: string };
+
+function stdioFrame(payload: StdioRequest): string {
+  const body = JSON.stringify(payload);
+  return `Content-Length: ${Buffer.byteLength(body, "utf-8")}\r\n\r\n${body}`;
+}
+
+function readStdioMessages(raw: string): StdioMessage[] {
+  const messages: StdioMessage[] = [];
+  let rest = raw;
+  while (rest.length > 0) {
+    const headerEnd = rest.indexOf("\r\n\r\n");
+    assert.ok(headerEnd >= 0, "server output must be Content-Length framed");
+    const length = Number.parseInt(rest.slice(0, headerEnd).split(":")[1] ?? "", 10);
+    const message: StdioMessage = JSON.parse(rest.slice(headerEnd + 4, headerEnd + 4 + length));
+    messages.push(message);
+    rest = rest.slice(headerEnd + 4 + length);
+  }
+  return messages;
+}
+
+/** Feeds each chunk in its own tick so the server sees separate data events. */
+async function runStdioChunks(chunks: string[]): Promise<StdioMessage[]> {
+  const input = new PassThrough();
+  const output = new PassThrough();
+  output.setEncoding("utf8");
+  let raw = "";
+  output.on("data", (chunk: string) => {
+    raw += chunk;
+  });
+  const running = new EngramMcpServer(makeMockService()).runStdio(input, output);
+  for (const chunk of chunks) {
+    input.write(chunk);
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+  input.end();
+  await running;
+  return readStdioMessages(raw);
+}
+
+const stdioPing = (id: number) => stdioFrame({ jsonrpc: "2.0", id, method: "ping" });
+
+test("MCP stdio refuses an oversized Content-Length, discards its body, and answers the next frame", async () => {
+  const declared = MCP_STDIO_MAX_FRAME_BYTES + 1;
+  const messages = await runStdioChunks([
+    `Content-Length: ${declared}\r\n\r\n`,
+    "x".repeat(1000),
+    "x".repeat(declared - 1000),
+    stdioPing(7),
+  ]);
+  assert.equal(messages.length, 2);
+  assert.match(messages[0]?.error?.message ?? "", /frame too large/);
+  assert.equal(messages[1]?.id, 7);
+  assert.ok(messages[1]?.result, "the frame after the refused one is answered normally");
+});
+
+test("MCP stdio refuses a header that never terminates and answers the next frame", async () => {
+  const messages = await runStdioChunks(["A".repeat(MCP_STDIO_MAX_FRAME_BYTES + 1), stdioPing(8)]);
+  assert.equal(messages.length, 2);
+  assert.match(messages[0]?.error?.message ?? "", /frame too large/);
+  assert.equal(messages[1]?.id, 8);
+});
+
+test("MCP stdio reassembles a frame split inside its header and inside its body", async () => {
+  const frame = stdioPing(9);
+  const messages = await runStdioChunks([frame.slice(0, 6), frame.slice(6, frame.length - 4), frame.slice(frame.length - 4)]);
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0]?.id, 9);
+});

package/src/access-mcp.ts

@@ -30,7 +30,9 @@ import {
   validateRequest,
 } from "./access-schema.js";
 import { EngramAccessInputError, type EngramAccessRecallResponse, type EngramAccessService } from "./access-service.js";
-import { unknownToolError } from "./access-errors.js";
+import { EngramAccessForbiddenError, unknownToolError } from "./access-errors.js";
+import { log } from "./logger.js";
+import { McpFrameReader } from "./access-mcp-frames.js";
 import "./access-operations.js";
 import { validateBriefingFormat } from "./briefing.js";
 import { processChatMessage } from "./chat/chat-factory.js";
@@ -88,6 +90,19 @@ function throwMcpAbort(signal: AbortSignal | undefined, message: string): void {
   throw abortError(message);
 }
 
+/**
+ * Map tools/call failures to a client-safe message. Unexpected backend/fs
+ * errors become a stable generic string; detail stays in the server log.
+ * Intended EngramAccessInputError / EngramAccessForbiddenError stay readable.
+ */
+function mcpToolErrorMessage(err: Error): string {
+  if (err instanceof EngramAccessInputError || err instanceof EngramAccessForbiddenError) {
+    return err.message;
+  }
+  log.error("engram MCP tools/call internal error", err);
+  return "internal error";
+}
+
 type McpRequestOptions = {
   principalOverride?: string;
   namespaceOverride?: string;
@@ -406,7 +421,7 @@ function parseMcpRequest<N extends SchemaName>(schemaName: N, args: Record<strin
 function optionalNonEmptyString(value: unknown, label: string): string | undefined {
   if (value === undefined || value === null || value === "") return undefined;
   if (typeof value !== "string") {
-    throw new Error(`${label} expects a string; got ${JSON.stringify(value)}`);
+    throw new EngramAccessInputError(`${label} expects a string; got ${JSON.stringify(value)}`);
   }
   return value;
 }
@@ -420,11 +435,11 @@ function optionalNonEmptyString(value: unknown, label: string): string | undefin
 function optionalPositiveInteger(value: unknown, label: string): number | undefined {
   if (value === undefined || value === null || value === "") return undefined;
   if (typeof value !== "number" && typeof value !== "string") {
-    throw new Error(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
   }
   const parsed = typeof value === "number" ? value : Number(value);
   if (!Number.isFinite(parsed) || parsed <= 0 || !Number.isInteger(parsed)) {
-    throw new Error(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
   }
   return parsed;
 }
@@ -447,7 +462,7 @@ async function getMcpServerVersion(): Promise<string> {
 }
 
 export class EngramMcpServer {
-  private buffer = Buffer.alloc(0);
+  private readonly frames = new McpFrameReader();
   private flushTask: Promise<void> | null = null;
   private readonly tools: McpTool[];
   private readonly resources: McpResource[];
@@ -2402,7 +2417,7 @@ export class EngramMcpServer {
         // Cancellation is transport control flow, not a JSON-RPC tool error.
         // Preserve the original AbortError so HTTP can silently end a dead socket.
         if (isAbortError(err)) throw err;
-        const message = err instanceof Error ? err.message : String(err);
+        const message = mcpToolErrorMessage(err instanceof Error ? err : new Error(String(err)));
         return {
           jsonrpc: "2.0",
           id,
@@ -2426,7 +2441,7 @@ export class EngramMcpServer {
 
   async runStdio(input: Readable, output: Writable): Promise<void> {
     input.on("data", (chunk) => {
-      this.buffer = Buffer.concat([this.buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+      this.frames.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
       this.scheduleFlush(output);
     });
     await new Promise<void>((resolve, reject) => {
@@ -2455,7 +2470,7 @@ export class EngramMcpServer {
         if (this.flushTask === task) {
           this.flushTask = null;
         }
-        if (this.buffer.length > 0) {
+        if (this.frames.hasUnread()) {
           this.scheduleFlush(output);
         }
       });
@@ -2463,30 +2478,15 @@ export class EngramMcpServer {
   }
 
   private async flushBuffer(output: Writable): Promise<void> {
-    while (true) {
-      const headerEnd = this.buffer.indexOf("\r\n\r\n");
-      if (headerEnd < 0) return;
-      const headerText = this.buffer.slice(0, headerEnd).toString("utf-8");
-      const headers = headerText.split("\r\n");
-      const contentLengthHeader = headers.find((line) => line.toLowerCase().startsWith("content-length:"));
-      if (!contentLengthHeader) {
-        this.buffer = Buffer.alloc(0);
-        return;
-      }
-      const contentLength = Number.parseInt(contentLengthHeader.split(":")[1]?.trim() ?? "0", 10);
-      if (!Number.isFinite(contentLength) || contentLength < 0) {
-        this.buffer = Buffer.alloc(0);
-        return;
+    for (let frame = this.frames.next(); frame; frame = this.frames.next()) {
+      if (frame.kind === "too-large") {
+        this.writeMessage(output, { jsonrpc: "2.0", id: null, error: { code: -32600, message: "frame too large" } });
+        continue;
       }
-      const messageStart = headerEnd + 4;
-      const messageEnd = messageStart + contentLength;
-      if (this.buffer.length < messageEnd) return;
-      const body = this.buffer.slice(messageStart, messageEnd).toString("utf-8");
-      this.buffer = this.buffer.slice(messageEnd);
-
       let parsed: JsonRpcRequest;
       try {
-        parsed = JSON.parse(body) as JsonRpcRequest;
+        // SAFETY: handleRequest defaults missing fields; a non-object body throws and scheduleFlush answers -32700.
+        parsed = JSON.parse(frame.text) as JsonRpcRequest;
       } catch {
         this.writeMessage(output, {
           jsonrpc: "2.0",
@@ -2620,7 +2620,7 @@ export class EngramMcpServer {
             caps?.ops === undefined || capabilityAllowsOp(caps, MCP_MIGRATED_OPERATIONS[toLegacyToolName(t.name)] ?? "")
         )
         .map((t) => t.name);
-      throw new Error(unknownToolError(name, visible));
+      throw new EngramAccessInputError(unknownToolError(name, visible));
     }
     const op = getOperation(migrated);
     if (!op) {

package/src/access-observe-write-surface.ts

@@ -51,6 +51,7 @@ import {
   queueExplicitCaptureForReview,
 } from "./explicit-capture.js";
 import { log } from "./logger.js";
+import { embeddingBacklogExceeds, isSearchHealthDegraded } from "./namespaces/search.js";
 import { recordObjectiveStateSnapshotsFromObservedMessages } from "./objective-state-writers.js";
 import type { Orchestrator } from "./orchestrator.js";
 import { displayErrorDetail } from "./runtime/better-sqlite.js";
@@ -289,7 +290,7 @@ export class AccessObserveWriteSurface {
         /* status probe failed — non-fatal */
       }
     }
-    if (threshold > 0 && pendingEmbeddings !== null && pendingEmbeddings > threshold) {
+    if (embeddingBacklogExceeds(pendingEmbeddings, threshold)) {
       degraded = true;
       degradedReason = `embedding-backlog: ${pendingEmbeddings} pending > threshold ${threshold}`;
     }
@@ -355,14 +356,13 @@ export class AccessObserveWriteSurface {
       const pending = health.pendingEmbeddings ?? null;
       const oldest = health.oldestPendingAgeMs ?? null;
       const threshold = this.deps.orchestrator.config.qmdEmbeddingBacklogThreshold;
-      const backlogDegraded = threshold > 0 && pending !== null && pending > threshold;
-      const degraded = !active || health.collectionState === "unknown" || backlogDegraded;
+      const backlogDegraded = embeddingBacklogExceeds(pending, threshold);
       const mode = !active ? "fallback" : health.daemonMode === true ? "daemon" : "cli";
 
       return {
         enabled: true,
         active,
-        degraded,
+        degraded: isSearchHealthDegraded({ ...health, pendingEmbeddings: pending }, threshold),
         mode,
         collection: health.collection || fallbackCollection,
         collectionState: health.collectionState,