@robota-sdk/agent-transport 3.0.0-beta.100

package/src/__tests__/admission.test.ts

@@ -0,0 +1,130 @@
+/**
+ * SEC-008 — the admission seam's own cases.
+ *
+ * `resolveAdmission` had none. It was exercised only THROUGH the four transports that call it, and
+ * both defects review found here are ones that indirection hides: a transport passing a well-formed
+ * config never exhibits either.
+ *
+ * The seam's whole claim is "one place to read and one place to change". A seam nobody tests
+ * directly is one place to read and four places to find out you were wrong.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { bearerCredential, resolveAdmission } from '../node/admission.js';
+
+const OPEN_REASON = 'loopback only, the port is bound to 127.0.0.1';
+
+describe('resolveAdmission is secure by default', () => {
+  it('mints when nothing is asked for', () => {
+    const admission = resolveAdmission();
+
+    expect(admission.token).toMatch(/^[0-9a-f]{64}$/);
+    expect(admission.openReason).toBeUndefined();
+  });
+
+  it('keeps an explicit token', () => {
+    expect(resolveAdmission({ token: 'chosen-by-the-host' })).toEqual({
+      token: 'chosen-by-the-host',
+    });
+  });
+
+  it('opens only with a reason', () => {
+    expect(resolveAdmission({ open: true, openReason: OPEN_REASON })).toEqual({
+      token: null,
+      openReason: OPEN_REASON,
+    });
+    expect(() => resolveAdmission({ open: true })).toThrow(/requires `openReason`/);
+    expect(() => resolveAdmission({ open: true, openReason: '   ' })).toThrow(
+      /requires `openReason`/,
+    );
+  });
+
+  it('MINTS for an empty-string token rather than requiring the empty string', () => {
+    // The value behind the discriminator defect. `{ token: '' }` is documented as "mint a fresh
+    // one", and the HTTP route's `'token' in options.admission` read it as ALREADY RESOLVED and
+    // installed the empty string as the required credential — which a peer sending an empty bearer
+    // then matches. The route no longer discriminates; this pins the value it depends on.
+    expect(resolveAdmission({ token: '' }).token).toMatch(/^[0-9a-f]{64}$/);
+  });
+});
+
+describe('resolveAdmission is idempotent', () => {
+  // Why it must be: the HTTP route accepts either shape, and BOTH interfaces declare a `token`, so
+  // they cannot be told apart structurally. Making the function accept its own output deletes that
+  // question instead of answering it wrongly.
+  it('returns an already-resolved token admission unchanged', () => {
+    const resolved = resolveAdmission({ token: 'chosen-by-the-host' });
+
+    expect(resolveAdmission(resolved)).toEqual(resolved);
+  });
+
+  it('returns an already-resolved OPEN admission unchanged, reason and all', () => {
+    // The case that made the old code wrong in the dangerous direction: re-resolving an open
+    // admission through a config-shaped path either minted a token nobody holds or dropped the
+    // reason and left an unexplained open transport.
+    const resolved = resolveAdmission({ open: true, openReason: OPEN_REASON });
+
+    expect(resolved).toEqual({ token: null, openReason: OPEN_REASON });
+    expect(resolveAdmission(resolved)).toEqual(resolved);
+  });
+
+  it('REFUSES an open admission that arrives without its reason', () => {
+    // `token: null` is the recorded outcome of a decision. One reaching here with no reason was
+    // hand-built or corrupted, and both are the unexplained-open state the reason exists to
+    // prevent — so it is refused rather than passed through.
+    expect(() => resolveAdmission({ token: null })).toThrow(/requires `openReason`/);
+  });
+});
+
+describe('resolveAdmission refuses a contradiction', () => {
+  it('throws when a token and `open: true` are asked for together', () => {
+    // Review: `WebRtcTransport` already refused the analogous `secret` + `open` pair in its own
+    // constructor, so only WebRTC callers were protected. The old seam gave silent precedence to
+    // the token — the safe DIRECTION, but the wrong ANSWER: a caller that wrote both does not know
+    // what it is asking for, and one of the two things it believes is false.
+    expect(() =>
+      resolveAdmission({ token: 'a-credential', open: true, openReason: OPEN_REASON }),
+    ).toThrow(/contradictory/);
+  });
+
+  it('still accepts `open: false` beside a token, which is not a contradiction', () => {
+    // `open: false` says the same thing the token does. Refusing it would turn a redundant but
+    // coherent config into an error, which is over-blocking for nothing.
+    expect(resolveAdmission({ token: 'a-credential', open: false })).toEqual({
+      token: 'a-credential',
+    });
+  });
+});
+
+describe('bearerCredential reads the header the way RFC 7235 defines it', () => {
+  it('matches the SCHEME without regard to case', () => {
+    // `auth-scheme` is a token, and tokens compare case-insensitively. The exact-case match refused
+    // a conformant client with a 401 it could not act on — a refusal that reads as a server bug and
+    // gets worked around rather than fixed. Review found it.
+    expect(bearerCredential('bearer abc123')).toBe('abc123');
+    expect(bearerCredential('BEARER abc123')).toBe('abc123');
+    expect(bearerCredential('BeArEr abc123')).toBe('abc123');
+  });
+
+  it('leaves the CREDENTIAL exactly as sent', () => {
+    // Only the scheme is case-insensitive. The credential is compared byte for byte, so folding it
+    // would make two different secrets the same secret.
+    expect(bearerCredential('Bearer AbC')).toBe('AbC');
+  });
+
+  it('accepts more than one space between the two', () => {
+    expect(bearerCredential('Bearer   abc123')).toBe('abc123');
+    expect(bearerCredential('Bearer\tabc123')).toBe('abc123');
+  });
+
+  it('refuses a header that merely STARTS with the word', () => {
+    // `Bearerness xyz` is a different scheme, and reading it as a bearer token would admit a peer
+    // that never claimed to be one.
+    expect(bearerCredential('Bearerness xyz')).toBeUndefined();
+    expect(bearerCredential('Basic abc123')).toBeUndefined();
+    expect(bearerCredential('Bearer')).toBeUndefined();
+    expect(bearerCredential('Bearer ')).toBeUndefined();
+    expect(bearerCredential(undefined)).toBeUndefined();
+  });
+});

package/src/__tests__/app-tool-messages.test.ts

@@ -0,0 +1,463 @@
+/**
+ * A driving surface hosting an MCP app view invokes one runtime tool through the session's
+ * permission gate and reads a finished call's view on demand. Drive-only: the observer allowlist
+ * does not list either message. A call is limited to the tools of the view it names, a connection
+ * that goes away cancels its calls, and no answering frame exceeds what the channel carries.
+ */
+import { createTestInteractiveSession } from '@robota-sdk/agent-interface-session/testing';
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+  handleAppToolMessage,
+  handleAppViewMessage,
+  isAppToolMessage,
+  isAppViewMessage,
+} from '../app-tool-messages.js';
+import { MAX_INBOUND_FRAME_BYTES } from '../message-decoders.js';
+import { isObserverMessageType } from '../observer-messages.js';
+import { createOutboundDelivery } from '../outbound-delivery.js';
+import { createSessionMessageHandler } from '../session-message-handler.js';
+
+import type { TOutboundDeliver } from '../outbound-delivery.js';
+import type { TClientMessage, TServerMessage } from '../wire-messages.js';
+import type { IToolAppView, IToolExecutionResult } from '@robota-sdk/agent-core';
+import type {
+  IInteractiveSession,
+  IRuntimeToolInvokeOptions,
+  ISessionRuntimeTools,
+  ISessionToolAppViews,
+} from '@robota-sdk/agent-interface-session';
+
+function collect(): { sent: TServerMessage[]; deliver: TOutboundDeliver } {
+  const sent: TServerMessage[] = [];
+  return { sent, deliver: createOutboundDelivery((m) => sent.push(m), vi.fn()) };
+}
+
+const view: IToolAppView = {
+  sourceId: 'files',
+  resourceUri: 'ui://files/list',
+  mimeType: 'text/html;profile=mcp-app',
+  html: '<main>rows</main>',
+  callableTools: { list_files: 'mcp__files__list_files' },
+};
+
+type TAppSession = ISessionRuntimeTools & ISessionToolAppViews;
+
+function appSession(overrides: Partial<TAppSession> = {}): TAppSession {
+  return {
+    listRuntimeTools: vi.fn(),
+    invokeRuntimeTool: vi.fn(),
+    readToolAppView: vi.fn().mockReturnValue(view),
+    ...overrides,
+  };
+}
+
+function result(overrides: Partial<IToolExecutionResult> = {}): IToolExecutionResult {
+  return { success: true, toolName: 'mcp__files__list_files', ...overrides };
+}
+
+describe('call-app-tool', () => {
+  const call: Extract<TClientMessage, { type: 'call-app-tool' }> = {
+    type: 'call-app-tool',
+    requestId: 'app-tool-1',
+    viewId: 'view-1',
+    name: 'mcp__files__list_files',
+    arguments: { path: 'src' },
+  };
+
+  it('is recognised, and is not a message an observer may send', () => {
+    expect(isAppToolMessage(call)).toBe(true);
+    expect(isAppToolMessage({ type: 'get-status' })).toBe(false);
+    expect(isObserverMessageType('call-app-tool')).toBe(false);
+  });
+
+  it('invokes interactively for the connection driver and answers the correlated result', async () => {
+    const { sent, deliver } = collect();
+    const session = appSession({
+      invokeRuntimeTool: vi.fn().mockResolvedValue(
+        result({ result: { rows: 3 }, parts: [{ type: 'text', text: 'three rows' }] }),
+      ),
+    });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7');
+    await vi.waitFor(() => expect(sent).toHaveLength(1));
+
+    expect(session.readToolAppView).toHaveBeenCalledExactlyOnceWith('view-1');
+    expect(session.invokeRuntimeTool).toHaveBeenCalledExactlyOnceWith(
+      'mcp__files__list_files',
+      { path: 'src' },
+      { permissionInteraction: 'interactive', driverId: 'attach:7' },
+    );
+    expect(sent).toEqual([
+      {
+        type: 'app_tool_result',
+        requestId: 'app-tool-1',
+        success: true,
+        data: { rows: 3 },
+        parts: [{ type: 'text', text: 'three rows' }],
+      },
+    ]);
+  });
+
+  it('names no driver for a connection that has none, and answers a failure without data', async () => {
+    const { sent, deliver } = collect();
+    const session = appSession({
+      invokeRuntimeTool: vi.fn().mockResolvedValue(result({ success: false, error: 'Permission denied' })),
+    });
+
+    handleAppToolMessage(session, deliver, call);
+    await vi.waitFor(() => expect(sent).toHaveLength(1));
+
+    expect(session.invokeRuntimeTool).toHaveBeenCalledExactlyOnceWith(
+      'mcp__files__list_files',
+      { path: 'src' },
+      { permissionInteraction: 'interactive' },
+    );
+    expect(sent).toEqual([
+      { type: 'app_tool_result', requestId: 'app-tool-1', success: false, error: 'Permission denied' },
+    ]);
+  });
+
+  it('answers a refused invocation with a protocol_error carrying the requestId', async () => {
+    const { sent, deliver } = collect();
+    const session = appSession({
+      invokeRuntimeTool: vi
+        .fn()
+        .mockRejectedValue(new Error('Another prompt or command is already running.')),
+    });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7');
+    await vi.waitFor(() => expect(sent).toHaveLength(1));
+
+    expect(sent).toEqual([
+      {
+        type: 'protocol_error',
+        message: 'Another prompt or command is already running.',
+        requestId: 'app-tool-1',
+      },
+    ]);
+  });
+
+  it('refuses a call for a view the session no longer holds, without invoking anything', () => {
+    const { sent, deliver } = collect();
+    const session = appSession({ readToolAppView: vi.fn().mockReturnValue(undefined) });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7');
+
+    expect(sent).toEqual([
+      {
+        type: 'protocol_error',
+        message: 'This app view is no longer available.',
+        requestId: 'app-tool-1',
+      },
+    ]);
+    expect(session.invokeRuntimeTool).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['a tool of another source', 'mcp__other__delete_everything'],
+    ['the source-side name rather than the runtime name', 'list_files'],
+    ['a built-in tool', 'Bash'],
+    ['a property of the map rather than a tool', 'toString'],
+  ])('refuses %s: the view reaches only the tools its own source declared', (_label, name) => {
+    const { sent, deliver } = collect();
+    const session = appSession();
+
+    handleAppToolMessage(session, deliver, { ...call, name }, 'attach:7');
+
+    expect(sent).toEqual([
+      {
+        type: 'protocol_error',
+        message: 'This tool is not available to this app view.',
+        requestId: 'app-tool-1',
+      },
+    ]);
+    expect(session.invokeRuntimeTool).not.toHaveBeenCalled();
+  });
+
+  it('answers a tool result too large for the channel with a protocol_error instead of the frame', async () => {
+    const { sent, deliver } = collect();
+    const session = appSession({
+      invokeRuntimeTool: vi.fn().mockResolvedValue(result({ result: 'x'.repeat(2_000) })),
+    });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7', { maxFrameBytes: 1_000 });
+    await vi.waitFor(() => expect(sent).toHaveLength(1));
+
+    expect(sent).toEqual([
+      {
+        type: 'protocol_error',
+        message: 'This app tool result is too large to send.',
+        requestId: 'app-tool-1',
+      },
+    ]);
+  });
+
+  it('sends a tool result that fits the limit', async () => {
+    const { sent, deliver } = collect();
+    const session = appSession({
+      invokeRuntimeTool: vi.fn().mockResolvedValue(result({ result: 'small' })),
+    });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7', { maxFrameBytes: 1_000 });
+    await vi.waitFor(() => expect(sent).toHaveLength(1));
+
+    expect(sent[0]).toMatchObject({ type: 'app_tool_result', data: 'small' });
+  });
+
+  it('keeps the margin the resume bridge needs beneath the inbound limit by default', async () => {
+    const { sent, deliver } = collect();
+    const nearLimit = 'x'.repeat(MAX_INBOUND_FRAME_BYTES - 500);
+    const session = appSession({
+      invokeRuntimeTool: vi.fn().mockResolvedValue(result({ result: nearLimit })),
+    });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7');
+    await vi.waitFor(() => expect(sent).toHaveLength(1));
+
+    // Within the inbound limit, but a `seq` stamp added afterwards would carry it past.
+    expect(sent[0]).toMatchObject({ type: 'protocol_error' });
+  });
+
+  it('passes the connection signal to the invocation and answers nobody once it aborts', async () => {
+    const { sent, deliver } = collect();
+    const connection = new AbortController();
+    let seen: IRuntimeToolInvokeOptions | undefined;
+    let settled = false;
+    const session = appSession({
+      invokeRuntimeTool: vi.fn(
+        (_name: string, _arguments: unknown, options?: IRuntimeToolInvokeOptions) =>
+          new Promise<IToolExecutionResult>((resolve) => {
+            seen = options;
+            options?.signal?.addEventListener('abort', () => {
+              settled = true;
+              resolve(result({ success: false, error: 'cancelled' }));
+            });
+          }),
+      ),
+    });
+
+    handleAppToolMessage(session, deliver, call, 'attach:7', { signal: connection.signal });
+    await vi.waitFor(() => expect(seen).toBeDefined());
+    expect(seen?.signal).toBe(connection.signal);
+    connection.abort();
+    await vi.waitFor(() => expect(settled).toBe(true));
+    // The handler's continuation runs as a microtask of that settlement; a macrotask is past it.
+    await new Promise((resolve) => setImmediate(resolve));
+
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('call-app-tool on a connection that is already gone', () => {
+  it('answers nobody when the invocation is refused because its signal was already aborted', async () => {
+    const { sent, deliver } = collect();
+    const connection = new AbortController();
+    connection.abort();
+    let refused = false;
+    const session = appSession({
+      invokeRuntimeTool: vi.fn((_name: string, _arguments: unknown, options?: IRuntimeToolInvokeOptions) => {
+        refused = true;
+        return Promise.reject(options?.signal?.reason ?? new Error('aborted'));
+      }),
+    });
+
+    handleAppToolMessage(
+      session,
+      deliver,
+      { type: 'call-app-tool', requestId: 'c1', viewId: 'view-1', name: 'mcp__files__list_files', arguments: {} },
+      'attach:7',
+      { signal: connection.signal },
+    );
+    await vi.waitFor(() => expect(refused).toBe(true));
+    await new Promise((resolve) => setImmediate(resolve));
+
+    expect(sent).toEqual([]);
+  });
+});
+
+describe('read-app-view', () => {
+  const read: Extract<TClientMessage, { type: 'read-app-view' }> = {
+    type: 'read-app-view',
+    requestId: 'app-view-1',
+    viewId: 'view-1',
+  };
+
+  it('is recognised, and is not a message an observer may send', () => {
+    expect(isAppViewMessage(read)).toBe(true);
+    expect(isAppViewMessage({ type: 'get-status' })).toBe(false);
+    expect(isObserverMessageType('read-app-view')).toBe(false);
+  });
+
+  it('answers the view the session holds under that id', () => {
+    const { sent, deliver } = collect();
+    const readToolAppView = vi.fn().mockReturnValue(view);
+    handleAppViewMessage({ readToolAppView }, deliver, read);
+    expect(readToolAppView).toHaveBeenCalledExactlyOnceWith('view-1');
+    expect(sent).toEqual([{ type: 'app_view', requestId: 'app-view-1', view }]);
+  });
+
+  it('says the view is gone when the session no longer holds it', () => {
+    const { sent, deliver } = collect();
+    handleAppViewMessage({ readToolAppView: () => undefined }, deliver, read);
+    expect(sent).toEqual([
+      {
+        type: 'protocol_error',
+        message: 'This app view is no longer available.',
+        requestId: 'app-view-1',
+      },
+    ]);
+  });
+
+  it('refuses a view whose frame would pass the limit instead of sending it', () => {
+    const { sent, deliver } = collect();
+    const large = { ...view, html: 'x'.repeat(MAX_INBOUND_FRAME_BYTES) };
+    handleAppViewMessage({ readToolAppView: () => large }, deliver, read);
+    expect(sent).toEqual([
+      {
+        type: 'protocol_error',
+        message: 'This app view is too large to send.',
+        requestId: 'app-view-1',
+      },
+    ]);
+  });
+
+  it('refuses a frame in the margin the resume bridge needs beneath the inbound limit', () => {
+    const { sent, deliver } = collect();
+    const fixed = JSON.stringify({ type: 'app_view', requestId: 'app-view-1', view: { ...view, html: '' } });
+    const nearLimit = {
+      ...view,
+      html: 'x'.repeat(MAX_INBOUND_FRAME_BYTES - Buffer.byteLength(fixed) - 100),
+    };
+    handleAppViewMessage({ readToolAppView: () => nearLimit }, deliver, read);
+    expect(sent).toMatchObject([{ type: 'protocol_error' }]);
+  });
+
+  it('counts bytes, not characters, against the limit', () => {
+    const { sent, deliver } = collect();
+    // Half the limit in characters, but three bytes each: past the limit once encoded.
+    const wide = { ...view, html: '€'.repeat(Math.ceil(MAX_INBOUND_FRAME_BYTES / 2)) };
+    handleAppViewMessage({ readToolAppView: () => wide }, deliver, read);
+    expect(sent).toMatchObject([{ type: 'protocol_error', message: 'This app view is too large to send.' }]);
+  });
+
+  it('holds a channel with a smaller limit to that limit, and still sends what fits', () => {
+    const { sent, deliver } = collect();
+    const medium = { ...view, html: 'x'.repeat(3_000) };
+    handleAppViewMessage({ readToolAppView: () => medium }, deliver, read, { maxFrameBytes: 2_000 });
+    expect(sent).toMatchObject([{ type: 'protocol_error', message: 'This app view is too large to send.' }]);
+
+    handleAppViewMessage({ readToolAppView: () => medium }, deliver, read, { maxFrameBytes: 4_000 });
+    expect(sent[1]).toMatchObject({ type: 'app_view', requestId: 'app-view-1' });
+  });
+});
+
+describe('through the session message handler', () => {
+  function attach(
+    session: IInteractiveSession,
+    extra: { role?: 'drive' | 'observe'; maxFrameBytes?: number } = {},
+  ) {
+    const sent: TServerMessage[] = [];
+    const { onMessage, cleanup } = createSessionMessageHandler({
+      session,
+      deliver: createOutboundDelivery((message) => sent.push(message), vi.fn()),
+      driverId: 'attach:3',
+      ...(extra.role === undefined ? {} : { role: extra.role }),
+      ...(extra.maxFrameBytes === undefined ? {} : { maxFrameBytes: extra.maxFrameBytes }),
+    });
+    return { sent, send: (message: TClientMessage) => onMessage(JSON.stringify(message)), cleanup };
+  }
+
+  const call: TClientMessage = {
+    type: 'call-app-tool',
+    requestId: 'c1',
+    viewId: 'view-1',
+    name: 'mcp__files__list_files',
+    arguments: {},
+  };
+
+  it("runs a driving connection's call for its driver and reads the view for it", async () => {
+    const invokeRuntimeTool = vi.fn().mockResolvedValue(result({ result: 'ok' }));
+    const readToolAppView = vi.fn().mockReturnValue(view);
+    const session = createTestInteractiveSession({ invokeRuntimeTool, readToolAppView });
+    const drive = attach(session);
+
+    drive.send(call);
+    drive.send({ type: 'read-app-view', requestId: 'v1', viewId: 'view-1' });
+    await vi.waitFor(() => expect(drive.sent).toHaveLength(2));
+
+    expect(invokeRuntimeTool).toHaveBeenCalledExactlyOnceWith(
+      'mcp__files__list_files',
+      {},
+      expect.objectContaining({ permissionInteraction: 'interactive', driverId: 'attach:3' }),
+    );
+    expect(drive.sent).toContainEqual({ type: 'app_view', requestId: 'v1', view });
+    expect(drive.sent).toContainEqual({
+      type: 'app_tool_result',
+      requestId: 'c1',
+      success: true,
+      data: 'ok',
+    });
+  });
+
+  it('refuses an observer both messages and touches neither the tools nor the views', () => {
+    const invokeRuntimeTool = vi.fn();
+    const readToolAppView = vi.fn();
+    const session = createTestInteractiveSession({ invokeRuntimeTool, readToolAppView });
+    const observer = attach(session, { role: 'observe' });
+
+    observer.send(call);
+    observer.send({ type: 'read-app-view', requestId: 'v1', viewId: 'view-1' });
+
+    expect(observer.sent).toEqual([
+      { type: 'protocol_error', message: 'Not permitted for an observer: call-app-tool' },
+      { type: 'protocol_error', message: 'Not permitted for an observer: read-app-view' },
+    ]);
+    expect(invokeRuntimeTool).not.toHaveBeenCalled();
+    expect(readToolAppView).not.toHaveBeenCalled();
+  });
+
+  it('cancels a call still waiting on its prompt when the connection goes away', async () => {
+    let seen: IRuntimeToolInvokeOptions | undefined;
+    let settled = false;
+    const invokeRuntimeTool = vi.fn(
+      (_name: string, _arguments: unknown, options?: IRuntimeToolInvokeOptions) =>
+        new Promise<IToolExecutionResult>((resolve) => {
+          seen = options;
+          options?.signal?.addEventListener('abort', () => {
+            settled = true;
+            resolve(result({ success: false, error: 'denied' }));
+          });
+        }),
+    );
+    const session = createTestInteractiveSession({
+      invokeRuntimeTool,
+      readToolAppView: vi.fn().mockReturnValue(view),
+    });
+    const drive = attach(session);
+
+    drive.send(call);
+    await vi.waitFor(() => expect(seen?.signal).toBeDefined());
+    expect(seen?.signal?.aborted).toBe(false);
+
+    drive.cleanup();
+
+    expect(seen?.signal?.aborted).toBe(true);
+    // The connection is gone: nothing is sent to it for the call it abandoned.
+    await vi.waitFor(() => expect(settled).toBe(true));
+    await new Promise((resolve) => setImmediate(resolve));
+    expect(drive.sent.filter((frame) => frame.type === 'app_tool_result')).toEqual([]);
+  });
+
+  it('holds app answers to the carrier limit it was given', async () => {
+    const readToolAppView = vi.fn().mockReturnValue({ ...view, html: 'x'.repeat(3_000) });
+    const session = createTestInteractiveSession({ readToolAppView });
+    const drive = attach(session, { maxFrameBytes: 2_000 });
+
+    drive.send({ type: 'read-app-view', requestId: 'v1', viewId: 'view-1' });
+
+    expect(drive.sent).toEqual([
+      { type: 'protocol_error', message: 'This app view is too large to send.', requestId: 'v1' },
+    ]);
+  });
+});