@salesforce/graphiti 10.10.2

package/src/mcp/tools/__tests__/sf-gql-discover.spec.ts

@@ -0,0 +1,320 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+
+import path from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { buildSchema, introspectionFromSchema } from "graphql";
+import { describe, expect, it } from "vitest";
+import { atomicWriteJson } from "../../../lib/fs-utils.js";
+import {
+	schemaCacheKeyForInstanceUrl,
+	schemaDir,
+	type SchemaMetadata,
+} from "../../../lib/introspect.js";
+import { type ObjectInfoResult } from "../../../lib/object-info.js";
+import { type PrimeDeps } from "../../../lib/prime-schema.js";
+import { primeSchemaCache } from "../../../lib/walker.js";
+import { registerSfGqlDiscoverTool } from "../sf-gql-discover.js";
+
+const ORG = "test-tool-discover";
+const ORG_URL = "https://test-tool-discover.my.salesforce.com";
+const SCHEMA = buildSchema(`
+	type Query { uiapi: UIAPI! }
+	type UIAPI { query: RecordQuery! }
+	type RecordQuery {
+		Account(first: Int, after: String): AccountConnection!
+	}
+	type AccountConnection { edges: [AccountEdge!]! }
+	type AccountEdge { node: Account! }
+	type Account { Id: ID!, Name: StringValue }
+	type StringValue { value: String }
+`);
+primeSchemaCache(ORG, SCHEMA);
+primeSchemaCache(ORG_URL, SCHEMA);
+
+const primeDeps: PrimeDeps = {
+	getOrgAuth: async () => ({
+		alias: ORG,
+		username: "u",
+		instanceUrl: ORG_URL,
+		accessToken: "t",
+		orgId: "00D",
+	}),
+	downloadSchema: async (auth) => {
+		const cacheKey = schemaCacheKeyForInstanceUrl(auth.instanceUrl);
+		const filePath = path.join(schemaDir(), `${cacheKey}.json`);
+		atomicWriteJson(filePath, { data: introspectionFromSchema(SCHEMA) });
+		const meta: SchemaMetadata = {
+			cacheKey,
+			instanceUrl: auth.instanceUrl,
+			typeCount: 0,
+			downloadedAt: new Date().toISOString(),
+			filePath,
+		};
+		return meta;
+	},
+};
+
+const ACCOUNT_INFO: ObjectInfoResult = {
+	apiName: "Account",
+	label: "Account",
+	labelPlural: "Accounts",
+	createable: true,
+	deletable: true,
+	updateable: true,
+	queryable: true,
+	searchable: true,
+	custom: false,
+	keyPrefix: "001",
+	nameFields: ["Name"],
+	defaultRecordTypeId: null,
+	fields: [
+		{
+			apiName: "Id",
+			label: "Account ID",
+			dataType: "ID",
+			required: false,
+			createable: false,
+			updateable: false,
+			calculated: false,
+			custom: false,
+			filterable: true,
+			sortable: true,
+			nameField: false,
+			reference: false,
+			relationshipName: null,
+			compound: false,
+			compoundFieldName: null,
+			defaultedOnCreate: false,
+			extraTypeInfo: null,
+			inlineHelpText: null,
+			precision: 0,
+			scale: 0,
+			referenceToInfos: [],
+			controllerName: null,
+			controllingFields: [],
+		},
+	],
+	childRelationships: [],
+	recordTypeInfos: [],
+	picklists: [],
+	fetchedAt: new Date().toISOString(),
+};
+
+async function connect(): Promise<{ client: Client; server: McpServer }> {
+	const server = new McpServer({ name: "graphiti-mcp", version: "test" });
+	registerSfGqlDiscoverTool(server, {
+		primeDeps,
+		getOrgAuth: async () => ({
+			alias: ORG,
+			username: "u",
+			instanceUrl: ORG_URL,
+			accessToken: "t",
+			orgId: "00D",
+		}),
+		getObjectInfo: async (_auth, _alias, name) => {
+			if (name === "Account") return ACCOUNT_INFO;
+			throw new Error(`No fixture for ${name}`);
+		},
+	});
+	const [c, s] = InMemoryTransport.createLinkedPair();
+	const client = new Client({ name: "test", version: "0.0.0" });
+	await Promise.all([server.connect(s), client.connect(c)]);
+	return { client, server };
+}
+
+describe("mcp/tools/sf-gql-discover", () => {
+	it("tools/list advertises sf_gql_discover with org/mode properties", async () => {
+		const { client, server } = await connect();
+		try {
+			const list = await client.listTools();
+			const tool = list.tools.find((t) => t.name === "sf_gql_discover");
+			expect(tool).toBeDefined();
+			const props =
+				(tool!.inputSchema as { properties?: Record<string, unknown> }).properties ?? {};
+			expect(props.org).toBeDefined();
+			expect(props.mode).toBeDefined();
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call list_objects returns the schema's queryable SObjects", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG, mode: "list_objects" },
+			});
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.type).toBe("text");
+			const parsed = JSON.parse(content[0]?.text ?? "{}") as {
+				mode: string;
+				objects: { name: string }[];
+			};
+			expect(parsed.mode).toBe("list_objects");
+			expect(parsed.objects.map((o) => o.name)).toContain("Account");
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call describe_object returns ObjectDescription", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG, mode: "describe_object", object: "Account" },
+			});
+			const content = result.content as { type: string; text?: string }[];
+			const parsed = JSON.parse(content[0]?.text ?? "{}") as {
+				mode: string;
+				object: { name: string; fields: { name: string }[] };
+			};
+			expect(parsed.mode).toBe("describe_object");
+			expect(parsed.object.name).toBe("Account");
+			expect(parsed.object.fields.map((f) => f.name)).toContain("Id");
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call with missing required arg returns validation error", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/mode/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call describe_object without object returns error", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG, mode: "describe_object" },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/object/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("rejects org alias containing shell metacharacters", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: "evil; rm -rf /", mode: "list_objects" },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/org/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("rejects object name containing path traversal", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG, mode: "describe_object", object: "../etc/passwd" },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/object/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("accepts org alias at the 80-char limit", async () => {
+		const { client, server } = await connect();
+		try {
+			const longOrg = "a".repeat(80);
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: longOrg, mode: "list_objects" },
+			});
+			// Org isn't primed so the call fails downstream, but it must
+			// pass zod validation — surface as a non-validation error.
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").not.toMatch(/org must match/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("rejects org alias one over the 80-char limit", async () => {
+		const { client, server } = await connect();
+		try {
+			const tooLongOrg = "a".repeat(81);
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: tooLongOrg, mode: "list_objects" },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/org/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("rejects search containing control characters", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG, mode: "list_objects", search: "foo\x00bar" },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/search/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("rejects search exceeding 100 characters", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_discover",
+				arguments: { org: ORG, mode: "list_objects", search: "a".repeat(101) },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/search/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+});

package/src/mcp/tools/__tests__/sf-gql-list.spec.ts

@@ -0,0 +1,128 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+
+import path from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { buildSchema, introspectionFromSchema } from "graphql";
+import { describe, expect, it } from "vitest";
+import { atomicWriteJson } from "../../../lib/fs-utils.js";
+import {
+	schemaCacheKeyForInstanceUrl,
+	schemaDir,
+	type SchemaMetadata,
+} from "../../../lib/introspect.js";
+import { type PrimeDeps } from "../../../lib/prime-schema.js";
+import { primeSchemaCache } from "../../../lib/walker.js";
+import { registerSfGqlListTool } from "../sf-gql-list.js";
+
+const ORG = "test-tool-list";
+const ORG_URL = "https://test-tool-list.my.salesforce.com";
+const SCHEMA = buildSchema(`
+	type Query { uiapi: UIAPI! }
+	type UIAPI { query: RecordQuery! }
+	type RecordQuery { Account(first: Int, after: String): AccountConnection! }
+	type AccountConnection { edges: [AccountEdge!]!, pageInfo: PageInfo! }
+	type AccountEdge { node: Account! }
+	type PageInfo { hasNextPage: Boolean!, endCursor: String }
+	type Account { Id: ID!, Name: StringValue }
+	type StringValue { value: String }
+`);
+primeSchemaCache(ORG, SCHEMA);
+primeSchemaCache(ORG_URL, SCHEMA);
+
+const primeDeps: PrimeDeps = {
+	getOrgAuth: async () => ({
+		alias: ORG,
+		username: "u",
+		instanceUrl: ORG_URL,
+		accessToken: "t",
+		orgId: "00D",
+	}),
+	downloadSchema: async (auth) => {
+		const cacheKey = schemaCacheKeyForInstanceUrl(auth.instanceUrl);
+		const filePath = path.join(schemaDir(), `${cacheKey}.json`);
+		atomicWriteJson(filePath, { data: introspectionFromSchema(SCHEMA) });
+		const meta: SchemaMetadata = {
+			cacheKey,
+			instanceUrl: auth.instanceUrl,
+			typeCount: 0,
+			downloadedAt: new Date().toISOString(),
+			filePath,
+		};
+		return meta;
+	},
+};
+
+async function connect(): Promise<{ client: Client; server: McpServer }> {
+	const server = new McpServer({ name: "graphiti-mcp", version: "test" });
+	registerSfGqlListTool(server, { primeDeps });
+	const [c, s] = InMemoryTransport.createLinkedPair();
+	const client = new Client({ name: "test", version: "0.0.0" });
+	await Promise.all([server.connect(s), client.connect(c)]);
+	return { client, server };
+}
+
+describe("mcp/tools/sf-gql-list", () => {
+	it("tools/list advertises sf_gql_list with org/object/fields properties", async () => {
+		const { client, server } = await connect();
+		try {
+			const list = await client.listTools();
+			const tool = list.tools.find((t) => t.name === "sf_gql_list");
+			expect(tool).toBeDefined();
+			const props =
+				(tool!.inputSchema as { properties?: Record<string, unknown> }).properties ?? {};
+			expect(props.org).toBeDefined();
+			expect(props.object).toBeDefined();
+			expect(props.fields).toBeDefined();
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call sf_gql_list returns ToolOutput JSON envelope", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_list",
+				arguments: { org: ORG, object: "Account", fields: ["Id", "Name"] },
+			});
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.type).toBe("text");
+			const parsed = JSON.parse(content[0]?.text ?? "{}") as {
+				query: string;
+				variables: unknown[];
+				types: string;
+				warnings: string[];
+			};
+			expect(parsed.query).toMatch(/\bAccountList\b/);
+			expect(parsed.query).toMatch(/Name\s*\{\s*value\s*\}/);
+			expect(Array.isArray(parsed.variables)).toBe(true);
+			expect(typeof parsed.types).toBe("string");
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call sf_gql_list with missing required arg returns validation error", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_list",
+				arguments: { org: ORG, object: "Account" },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text ?? "").toMatch(/fields/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+});

package/src/mcp/tools/__tests__/sf-gql-raw.spec.ts

@@ -0,0 +1,141 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+
+import path from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { buildSchema, introspectionFromSchema } from "graphql";
+import { describe, expect, it } from "vitest";
+import { atomicWriteJson } from "../../../lib/fs-utils.js";
+import {
+	schemaCacheKeyForInstanceUrl,
+	schemaDir,
+	type SchemaMetadata,
+} from "../../../lib/introspect.js";
+import { type PrimeDeps } from "../../../lib/prime-schema.js";
+import { primeSchemaCache } from "../../../lib/walker.js";
+import { createServer } from "../../server.js";
+import { registerSfGqlRawTool } from "../sf-gql-raw.js";
+
+const ORG = "test-tool-raw";
+const ORG_URL = "https://test-tool-raw.my.salesforce.com";
+const SCHEMA = buildSchema(`
+	type Query { uiapi: UIAPI! }
+	type UIAPI { query: RecordQuery! }
+	type RecordQuery { Case(first: Int, after: String, where: Case_Filter): CaseConnection! }
+	input Case_Filter { Status: PicklistOperators }
+	input PicklistOperators { eq: String }
+	type CaseConnection { edges: [CaseEdge!]!, pageInfo: PageInfo! }
+	type CaseEdge { node: Case! }
+	type PageInfo { hasNextPage: Boolean!, endCursor: String }
+	type Case { Id: ID!, Subject: StringValue, Status: StringValue }
+	type StringValue { value: String }
+`);
+primeSchemaCache(ORG, SCHEMA);
+primeSchemaCache(ORG_URL, SCHEMA);
+
+const primeDeps: PrimeDeps = {
+	getOrgAuth: async () => ({
+		alias: ORG,
+		username: "u",
+		instanceUrl: ORG_URL,
+		accessToken: "t",
+		orgId: "00D",
+	}),
+	downloadSchema: async (auth) => {
+		const cacheKey = schemaCacheKeyForInstanceUrl(auth.instanceUrl);
+		const filePath = path.join(schemaDir(), `${cacheKey}.json`);
+		atomicWriteJson(filePath, { data: introspectionFromSchema(SCHEMA) });
+		const meta: SchemaMetadata = {
+			cacheKey,
+			instanceUrl: auth.instanceUrl,
+			typeCount: 0,
+			downloadedAt: new Date().toISOString(),
+			filePath,
+		};
+		return meta;
+	},
+};
+
+async function connect(): Promise<{ client: Client; server: McpServer }> {
+	const server = new McpServer({ name: "graphiti-mcp", version: "test" });
+	registerSfGqlRawTool(server, { primeDeps });
+	const [c, s] = InMemoryTransport.createLinkedPair();
+	const client = new Client({ name: "test", version: "0.0.0" });
+	await Promise.all([server.connect(s), client.connect(c)]);
+	return { client, server };
+}
+
+describe("mcp/tools/sf-gql-raw", () => {
+	it("tools/list advertises sf_gql_raw with org/commands properties", async () => {
+		const { client, server } = await connect();
+		try {
+			const list = await client.listTools();
+			const tool = list.tools.find((t) => t.name === "sf_gql_raw");
+			expect(tool).toBeDefined();
+			const props =
+				(tool!.inputSchema as { properties?: Record<string, unknown> }).properties ?? {};
+			expect(props.org).toBeDefined();
+			expect(props.commands).toBeDefined();
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call sf_gql_raw renders a query from commands", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_raw",
+				arguments: {
+					org: ORG,
+					commands: ["select uiapi/query/Case/edges/node/Subject/value"],
+				},
+			});
+			expect(result.isError).toBeFalsy();
+			const content = result.content as { type: string; text?: string }[];
+			const parsed = JSON.parse(content[0]?.text ?? "{}") as { query: string };
+			expect(parsed.query).toMatch(/Subject\s*\{\s*value\s*\}/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
+	it("tools/call sf_gql_raw fails fast on a bad command", async () => {
+		const { client, server } = await connect();
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_raw",
+				arguments: { org: ORG, commands: ["bogus verb here"] },
+			});
+			expect(result.isError).toBe(true);
+			const content = result.content as { type: string; text?: string }[];
+			expect(content[0]?.text).toMatch(/command 0 \(bogus verb here\)/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+});
+
+describe("mcp/server registers sf_gql_raw", () => {
+	it("createServer advertises sf_gql_raw in tools/list", async () => {
+		const server = createServer();
+		const [c, s] = InMemoryTransport.createLinkedPair();
+		const client = new Client({ name: "test", version: "0.0.0" });
+		await Promise.all([server.connect(s), client.connect(c)]);
+		try {
+			const list = await client.listTools();
+			expect(list.tools.find((t) => t.name === "sf_gql_raw")).toBeDefined();
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+});